CBMC
|
Classes | |
struct | conditiont |
Public Types | |
typedef goto_functionst::goto_functiont | goto_functiont |
Public Member Functions | |
goto_check_ct (const namespacet &_ns, const optionst &_options, message_handlert &_message_handler) | |
void | goto_check (const irep_idt &function_identifier, goto_functiont &goto_function) |
void | collect_allocations (const goto_functionst &goto_functions) |
Fill the list of allocations allocationst with <address, size> for every allocation instruction. More... | |
Protected Types | |
enum | check_statust { ENABLE, DISABLE, CHECKED } |
activation statuses for named checks More... | |
using | guardt = std::function< exprt(exprt)> |
using | conditionst = std::list< conditiont > |
typedef std::set< std::pair< exprt, exprt > > | assertionst |
typedef optionst::value_listt | error_labelst |
typedef std::pair< exprt, exprt > | allocationt |
typedef std::list< allocationt > | allocationst |
using | named_check_statust = optionalt< std::pair< irep_idt, check_statust > > |
optional (named-check, status) pair More... | |
Protected Member Functions | |
void | check_rec_address (const exprt &expr, const guardt &guard) |
Check an address-of expression: if it is a dereference then check the pointer if it is an index then address-check the array and then check the index. More... | |
void | check_rec_logical_op (const exprt &expr, const guardt &guard) |
Check a logical operation: check each operand in separation while extending the guarding condition as follows. More... | |
void | check_rec_if (const if_exprt &if_expr, const guardt &guard) |
Check an if expression: check the if-condition alone, and then check the true/false-cases with the guard extended with if-condition and it's negation, respectively. More... | |
bool | check_rec_member (const member_exprt &member, const guardt &guard) |
Check that a member expression is valid: More... | |
void | check_rec_div (const div_exprt &div_expr, const guardt &guard) |
Check that a division is valid: check for division by zero, overflow and NaN (for floating point numbers). More... | |
void | check_rec_arithmetic_op (const exprt &expr, const guardt &guard) |
Check that an arithmetic operation is valid: overflow check, NaN-check (for floating point numbers), and pointer overflow check. More... | |
void | check_rec (const exprt &expr, const guardt &guard) |
Recursively descend into expr and run the appropriate check for each sub-expression, while collecting the condition for the check in guard . More... | |
void | check (const exprt &expr) |
Initiate the recursively analysis of expr with its ‘guard’ set to TRUE. More... | |
void | bounds_check (const exprt &, const guardt &) |
void | bounds_check_index (const index_exprt &, const guardt &) |
void | bounds_check_bit_count (const unary_exprt &, const guardt &) |
void | div_by_zero_check (const div_exprt &, const guardt &) |
void | mod_by_zero_check (const mod_exprt &, const guardt &) |
void | mod_overflow_check (const mod_exprt &, const guardt &) |
check a mod expression for the case INT_MIN % -1 More... | |
void | enum_range_check (const exprt &, const guardt &) |
void | undefined_shift_check (const shift_exprt &, const guardt &) |
void | pointer_rel_check (const binary_exprt &, const guardt &) |
void | pointer_overflow_check (const exprt &, const guardt &) |
void | pointer_validity_check (const dereference_exprt &expr, const exprt &src_expr, const guardt &guard) |
Generates VCCs for the validity of the given dereferencing operation. More... | |
void | pointer_primitive_check (const exprt &expr, const guardt &guard) |
Generates VCCs to check that pointers passed to pointer primitives are either null or valid. More... | |
bool | requires_pointer_primitive_check (const exprt &expr) |
Returns true if the given expression is a pointer primitive that requires validation of the operand to guard against misuse. More... | |
optionalt< goto_check_ct::conditiont > | get_pointer_is_null_condition (const exprt &address, const exprt &size) |
conditionst | get_pointer_points_to_valid_memory_conditions (const exprt &address, const exprt &size) |
exprt | is_in_bounds_of_some_explicit_allocation (const exprt &pointer, const exprt &size) |
conditionst | get_pointer_dereferenceable_conditions (const exprt &address, const exprt &size) |
void | integer_overflow_check (const exprt &, const guardt &) |
void | conversion_check (const exprt &, const guardt &) |
void | float_overflow_check (const exprt &, const guardt &) |
void | nan_check (const exprt &, const guardt &) |
optionalt< exprt > | rw_ok_check (exprt) |
expand the r_ok, w_ok and rw_ok predicates More... | |
std::string | array_name (const exprt &) |
void | add_guarded_property (const exprt &asserted_expr, const std::string &comment, const std::string &property_class, const source_locationt &source_location, const exprt &src_expr, const guardt &guard) |
Include the asserted_expr in the code conditioned by the guard . More... | |
void | invalidate (const exprt &lhs) |
Remove all assertions containing the symbol in lhs as well as all assertions containing dereference. More... | |
void | add_active_named_check_pragmas (source_locationt &source_location) const |
Adds "checked" pragmas for all currently active named checks on the given source location. More... | |
void | add_all_disable_named_check_pragmas (source_locationt &source_location) const |
Adds "disable" pragmas for all named checks on the given source location. More... | |
named_check_statust | match_named_check (const irep_idt &named_check) const |
Matches a named-check string of the form. More... | |
Protected Attributes | |
const namespacet & | ns |
std::unique_ptr< local_bitvector_analysist > | local_bitvector_analysis |
goto_programt::const_targett | current_target |
messaget | log |
const guardt | identity = [](exprt expr) { return expr; } |
goto_programt | new_code |
assertionst | assertions |
bool | enable_bounds_check |
bool | enable_pointer_check |
bool | enable_memory_leak_check |
bool | enable_div_by_zero_check |
bool | enable_enum_range_check |
bool | enable_signed_overflow_check |
bool | enable_unsigned_overflow_check |
bool | enable_pointer_overflow_check |
bool | enable_conversion_check |
bool | enable_undefined_shift_check |
bool | enable_float_overflow_check |
bool | enable_simplify |
bool | enable_nan_check |
bool | retain_trivial |
bool | enable_assert_to_assume |
bool | enable_pointer_primitive_check |
std::map< irep_idt, bool * > | name_to_flag |
Maps a named-check name to the corresponding boolean flag. More... | |
error_labelst | error_labels |
allocationst | allocations |
irep_idt | mode |
Definition at line 47 of file goto_check_c.cpp.
|
protected |
Definition at line 296 of file goto_check_c.cpp.
|
protected |
Definition at line 295 of file goto_check_c.cpp.
|
protected |
Definition at line 248 of file goto_check_c.cpp.
|
protected |
Definition at line 173 of file goto_check_c.cpp.
|
protected |
Definition at line 290 of file goto_check_c.cpp.
Definition at line 81 of file goto_check_c.cpp.
|
protected |
Definition at line 100 of file goto_check_c.cpp.
|
protected |
optional (named-check, status) pair
Definition at line 319 of file goto_check_c.cpp.
|
protected |
activation statuses for named checks
Enumerator | |
---|---|
ENABLE | |
DISABLE | |
CHECKED |
Definition at line 311 of file goto_check_c.cpp.
|
inline |
Definition at line 50 of file goto_check_c.cpp.
|
protected |
Adds "checked" pragmas for all currently active named checks on the given source location.
Definition at line 2433 of file goto_check_c.cpp.
|
protected |
Adds "disable" pragmas for all named checks on the given source location.
Definition at line 2441 of file goto_check_c.cpp.
|
protected |
Include the asserted_expr
in the code conditioned by the guard
.
asserted_expr | expression to be asserted |
comment | human readable comment |
property_class | classification of the property |
source_location | the source location of the original expression |
src_expr | the original expression to be included in the comment |
guard | the condition under which the asserted expression should be taken into account |
Definition at line 1706 of file goto_check_c.cpp.
|
protected |
Definition at line 1509 of file goto_check_c.cpp.
Definition at line 1514 of file goto_check_c.cpp.
|
protected |
Definition at line 1684 of file goto_check_c.cpp.
|
protected |
Definition at line 1531 of file goto_check_c.cpp.
|
protected |
Initiate the recursively analysis of expr
with its ‘guard’ set to TRUE.
expr | the expression to be checked |
Definition at line 1990 of file goto_check_c.cpp.
Recursively descend into expr
and run the appropriate check for each sub-expression, while collecting the condition for the check in guard
.
expr | the expression to be checked |
guard | the condition for when the check should be made |
Definition at line 1900 of file goto_check_c.cpp.
Check an address-of expression: if it is a dereference then check the pointer if it is an index then address-check the array and then check the index.
expr | the expression to be checked |
guard | the condition for the check |
Definition at line 1744 of file goto_check_c.cpp.
Check that an arithmetic operation is valid: overflow check, NaN-check (for floating point numbers), and pointer overflow check.
expr | the expression to be checked |
guard | the condition for the check |
Definition at line 1873 of file goto_check_c.cpp.
Check that a division is valid: check for division by zero, overflow and NaN (for floating point numbers).
div_expr | the expression to be checked |
guard | the condition for the check |
Definition at line 1858 of file goto_check_c.cpp.
Check an if expression: check the if-condition alone, and then check the true/false-cases with the guard extended with if-condition and it's negation, respectively.
if_expr | the expression to be checked |
guard | the condition for the check (extended with the (negation of the) if-condition for recursively calls) |
Definition at line 1794 of file goto_check_c.cpp.
Check a logical operation: check each operand in separation while extending the guarding condition as follows.
a /\ b /\ c ==> check(a, TRUE), check(b, a), check (c, a /\ b) a \/ b \/ c ==> check(a, TRUE), check(b, ~a), check (c, ~a /\ ~b)
expr | the expression to be checked |
guard | the condition for the check (extended with the previous operands (or their negations) for recursively calls) |
Definition at line 1767 of file goto_check_c.cpp.
|
protected |
Check that a member expression is valid:
member | the expression to be checked |
guard | the condition for the check |
member
or its sub-expressions Definition at line 1817 of file goto_check_c.cpp.
void goto_check_ct::collect_allocations | ( | const goto_functionst & | goto_functions | ) |
Fill the list of allocations allocationst with <address, size> for every allocation instruction.
Also check that each allocation is well-formed.
goto_functions | goto functions from which the allocations are to be collected |
Definition at line 423 of file goto_check_c.cpp.
Definition at line 666 of file goto_check_c.cpp.
Definition at line 496 of file goto_check_c.cpp.
Definition at line 517 of file goto_check_c.cpp.
Definition at line 1075 of file goto_check_c.cpp.
|
protected |
Definition at line 1496 of file goto_check_c.cpp.
|
protected |
Definition at line 2353 of file goto_check_c.cpp.
|
protected |
Definition at line 2275 of file goto_check_c.cpp.
void goto_check_ct::goto_check | ( | const irep_idt & | function_identifier, |
goto_functiont & | goto_function | ||
) |
Definition at line 2035 of file goto_check_c.cpp.
Definition at line 829 of file goto_check_c.cpp.
|
protected |
Remove all assertions containing the symbol in lhs
as well as all assertions containing dereference.
lhs | the left-hand-side expression whose symbol should be invalidated |
Definition at line 466 of file goto_check_c.cpp.
|
protected |
Definition at line 2374 of file goto_check_c.cpp.
|
protected |
Matches a named-check string of the form.
Definition at line 2449 of file goto_check_c.cpp.
Definition at line 612 of file goto_check_c.cpp.
check a mod expression for the case INT_MIN % -1
Definition at line 634 of file goto_check_c.cpp.
Definition at line 1183 of file goto_check_c.cpp.
Definition at line 1335 of file goto_check_c.cpp.
Generates VCCs to check that pointers passed to pointer primitives are either null or valid.
expr | the pointer primitive expression |
guard | the condition under which the operation happens |
Definition at line 1432 of file goto_check_c.cpp.
|
protected |
Definition at line 1291 of file goto_check_c.cpp.
|
protected |
Generates VCCs for the validity of the given dereferencing operation.
expr | the expression to be checked |
src_expr | The expression as found in the program, prior to any rewriting |
guard | the condition under which the operation happens |
Definition at line 1391 of file goto_check_c.cpp.
|
protected |
Returns true if the given expression is a pointer primitive that requires validation of the operand to guard against misuse.
expr | expression |
Definition at line 1478 of file goto_check_c.cpp.
expand the r_ok, w_ok and rw_ok predicates
Definition at line 1996 of file goto_check_c.cpp.
|
protected |
Definition at line 545 of file goto_check_c.cpp.
|
protected |
Definition at line 297 of file goto_check_c.cpp.
|
protected |
Definition at line 249 of file goto_check_c.cpp.
|
protected |
Definition at line 97 of file goto_check_c.cpp.
|
protected |
Definition at line 271 of file goto_check_c.cpp.
|
protected |
Definition at line 257 of file goto_check_c.cpp.
|
protected |
Definition at line 265 of file goto_check_c.cpp.
|
protected |
Definition at line 260 of file goto_check_c.cpp.
|
protected |
Definition at line 261 of file goto_check_c.cpp.
|
protected |
Definition at line 267 of file goto_check_c.cpp.
|
protected |
Definition at line 259 of file goto_check_c.cpp.
|
protected |
Definition at line 269 of file goto_check_c.cpp.
|
protected |
Definition at line 258 of file goto_check_c.cpp.
|
protected |
Definition at line 264 of file goto_check_c.cpp.
|
protected |
Definition at line 272 of file goto_check_c.cpp.
|
protected |
Definition at line 262 of file goto_check_c.cpp.
|
protected |
Definition at line 268 of file goto_check_c.cpp.
|
protected |
Definition at line 266 of file goto_check_c.cpp.
|
protected |
Definition at line 263 of file goto_check_c.cpp.
|
protected |
Definition at line 291 of file goto_check_c.cpp.
Definition at line 101 of file goto_check_c.cpp.
|
protected |
Definition at line 96 of file goto_check_c.cpp.
|
protected |
Definition at line 98 of file goto_check_c.cpp.
|
protected |
Definition at line 299 of file goto_check_c.cpp.
|
protected |
Maps a named-check name to the corresponding boolean flag.
Definition at line 275 of file goto_check_c.cpp.
|
protected |
Definition at line 247 of file goto_check_c.cpp.
|
protected |
Definition at line 95 of file goto_check_c.cpp.
|
protected |
Definition at line 270 of file goto_check_c.cpp.