expr2tc
goto_symext::symex_mem(
const bool is_malloc,
const expr2tc &lhs,
const sideeffect2t &code)
{
if (is_nil_expr(lhs))
return expr2tc(); // ignore
// size
type2tc type = code.alloctype;
expr2tc size = code.size;
bool size_is_one = false;
if (is_nil_expr(size))
size_is_one=true;
else
{
cur_state->rename(size);
mp_integer i;
if (is_constant_int2t(size) && to_constant_int2t(size).as_ulong() == 1)
size_is_one = true;
}
if (is_nil_type(type))
type = char_type2();
else if (is_union_type(type)) {
// Filter out creation of instantiated unions. They're now all byte arrays.
size_is_one = false;
type = char_type2();
}
unsigned int &dynamic_counter = get_dynamic_counter();
dynamic_counter++;
// value
symbolt symbol;
symbol.base_name = "dynamic_" + i2string(dynamic_counter) +
(size_is_one ? "_value" : "_array");
symbol.name = "symex_dynamic::" + id2string(symbol.base_name);
symbol.lvalue = true;
typet renamedtype = ns.follow(migrate_type_back(type));
if(size_is_one)
symbol.type=renamedtype;
else
{
symbol.type=typet(typet::t_array);
symbol.type.subtype()=renamedtype;
symbol.type.size(migrate_expr_back(size));
}
symbol.type.dynamic(true);
symbol.mode="C";
new_context.add(symbol);
type2tc new_type;
migrate_type(symbol.type, new_type);
address_of2tc rhs_addrof(get_empty_type(), expr2tc());
if(size_is_one)
{
rhs_addrof.get()->type = get_pointer_type(pointer_typet(symbol.type));
rhs_addrof.get()->ptr_obj = symbol2tc(new_type, symbol.name);
}
else
{
type2tc subtype;
migrate_type(symbol.type.subtype(), subtype);
expr2tc sym = symbol2tc(new_type, symbol.name);
expr2tc idx_val = zero_ulong;
expr2tc idx = index2tc(subtype, sym, idx_val);
rhs_addrof.get()->type =
get_pointer_type(pointer_typet(symbol.type.subtype()));
rhs_addrof.get()->ptr_obj = idx;
}
expr2tc rhs = rhs_addrof;
expr2tc ptr_rhs = rhs;
if (!options.get_bool_option("force-malloc-success")) {
symbol2tc null_sym(rhs->type, "NULL");
sideeffect2tc choice(get_bool_type(), expr2tc(), expr2tc(), std::vector<expr2tc>(), type2tc(), sideeffect2t::nondet);
rhs = if2tc(rhs->type, choice, rhs, null_sym);
replace_nondet(rhs);
ptr_rhs = rhs;
}
if (rhs->type != lhs->type)
rhs = typecast2tc(lhs->type, rhs);
cur_state->rename(rhs);
expr2tc rhs_copy(rhs);
guardt guard;
symex_assign_rec(lhs, rhs, guard);
pointer_object2tc ptr_obj(pointer_type2(), ptr_rhs);
track_new_pointer(ptr_obj, new_type);
dynamic_memory.push_back(allocated_obj(rhs_copy, cur_state->guard, !is_malloc));
return rhs_addrof->ptr_obj;
}
void goto_symext::symex_realloc(const expr2tc &lhs, const sideeffect2t &code)
{
expr2tc src_ptr = code.operand;
expr2tc realloc_size = code.size;
internal_deref_items.clear();
dereference2tc deref(get_empty_type(), src_ptr);
dereference(deref, dereferencet::INTERNAL);
// src_ptr is now invalidated.
// Free the given pointer. This just uses the pointer object from the pointer
// variable that's the argument to realloc. It also leads to pointer validity
// checking, and checks that the offset is zero.
code_free2tc fr(code.operand);
symex_free(fr);
// We now have a list of things to work on. Recurse into them, build a result,
// and then switch between those results afterwards.
// Result list is the address of the reallocated piece of data, and the guard.
std::list<std::pair<expr2tc, expr2tc>> result_list;
for(auto &item : internal_deref_items)
{
expr2tc guard = item.guard;
cur_state->rename_address(item.object);
cur_state->guard.guard_expr(guard);
target->renumber(guard, item.object, realloc_size, cur_state->source);
type2tc new_ptr = type2tc(new pointer_type2t(item.object->type));
address_of2tc addrof(new_ptr, item.object);
result_list.emplace_back(addrof, item.guard);
// Bump the realloc-numbering of the object. This ensures that, after
// renaming, the address_of we just generated compares differently to
// previous address_of's before the realloc.
unsigned int cur_num = 0;
if(cur_state->realloc_map.find(item.object) != cur_state->realloc_map.end())
{
cur_num = cur_state->realloc_map[item.object];
}
cur_num++;
std::map<expr2tc, unsigned>::value_type v(item.object, cur_num);
cur_state->realloc_map.insert(v);
}
// Rebuild a gigantic if-then-else chain from the result list.
expr2tc result;
if(result_list.size() == 0)
{
// Nothing happened; there was nothing, or only null, to point at.
// In this case, just return right now and leave the pointer free. The
// symex_free that occurred above should trigger a dereference failure.
return;
}
result = expr2tc();
for(auto const &it : result_list)
{
if(is_nil_expr(result))
result = it.first;
else
result = if2tc(result->type, it.second, it.first, result);
}
// Install pointer modelling data into the relevant arrays.
pointer_object2tc ptr_obj(pointer_type2(), result);
track_new_pointer(ptr_obj, type2tc(), realloc_size);
symex_assign(code_assign2tc(lhs, result), true);
}
