1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
[kernel] Parsing share/libc/__fc_builtin_for_normalization.i (no preprocessing)
[kernel] Parsing tests/value/pointer_arg.i (no preprocessing)
[value] Analyzing a complete application starting at main
[value] Computing initial state
[value] Initial state computed
[value:initial-state] Values of globals at initialization
v ∈ [--..--]
tests/value/pointer_arg.i:4:[value] warning: out of bounds write. assert \valid(arg + 0);
tests/value/pointer_arg.i:5:[value] warning: out of bounds write. assert \valid(arg + 1);
tests/value/pointer_arg.i:6:[value] warning: out of bounds write. assert \valid(arg + 2);
tests/value/pointer_arg.i:6:[kernel] warning: all target addresses were invalid. This path is assumed to be dead.
tests/value/pointer_arg.i:7:[value] warning: out of bounds write. assert \valid(arg + 1000);
tests/value/pointer_arg.i:7:[kernel] warning: all target addresses were invalid. This path is assumed to be dead.
tests/value/pointer_arg.i:8:[value] warning: out of bounds write. assert \valid(arg + argc);
tests/value/pointer_arg.i:11:[value] warning: out of bounds write. assert \valid(argv + 1);
tests/value/pointer_arg.i:15:[value] warning: out of bounds read. assert \valid_read(argv + 0);
tests/value/pointer_arg.i:15:[value] warning: out of bounds write. assert \valid(*(argv + 0) + 0);
[value] Recording results for main
[value] done for function main
tests/value/pointer_arg.i:6:[value] assertion 'Value,mem_access' got final status invalid.
tests/value/pointer_arg.i:7:[value] assertion 'Value,mem_access' got final status invalid.
[value] ====== VALUES COMPUTED ======
[value:final-states] Values at end of function main:
__retres ∈ {0}
S_argv[0] ∈ {{ &S_0_S_argv[0] }}
[1] ∈ {{ NULL ; &S_1_S_argv[0] ; "5069" }}
S_0_S_argv[0] ∈ {48}
[1] ∈ [--..--]
S_arg[0] ∈ {0; 4}
[1] ∈ {1; 4}
[from] Computing for function main
[from] Done for function main
[from] ====== DEPENDENCIES COMPUTED ======
These dependencies hold at termination for the executions that terminate:
[from] Function main:
S_argv[0..1] FROM v; argv (and SELF)
S_0_S_argv[0] FROM v; argv; S_argv[0]
S_arg[0..1] FROM arg; argc
\result FROM \nothing
[from] ====== END OF DEPENDENCIES ======
[inout] Out (internal) for function main:
__retres; S_argv[0..1]; S_0_S_argv[0]; S_arg[0..1]
[inout] Inputs for function main:
v; S_argv[0]
|
