String *ParmList_protostr(ParmList *p) { String *out = NewStringEmpty(); while (p) { String *type = Getattr(p, "type"); String *pstr = SwigType_str(type ? type : get_empty_type(), 0); Append(out, pstr); p = nextSibling(p); if (p) { Append(out, ","); } Delete(pstr); } return out; }
String *ParmList_str_defaultargs(ParmList *p) { String *out = NewStringEmpty(); while (p) { String *value = Getattr(p, "value"); String *type = Getattr(p, "type"); String *pstr = SwigType_str(type ? type : get_empty_type(), Getattr(p, "name")); Append(out, pstr); if (value) { Printf(out, "=%s", value); } p = nextSibling(p); if (p) { Append(out, ","); } Delete(pstr); } return out; }
expr2tc goto_symext::symex_mem( const bool is_malloc, const expr2tc &lhs, const sideeffect2t &code) { if (is_nil_expr(lhs)) return expr2tc(); // ignore // size type2tc type = code.alloctype; expr2tc size = code.size; bool size_is_one = false; if (is_nil_expr(size)) size_is_one=true; else { cur_state->rename(size); mp_integer i; if (is_constant_int2t(size) && to_constant_int2t(size).as_ulong() == 1) size_is_one = true; } if (is_nil_type(type)) type = char_type2(); else if (is_union_type(type)) { // Filter out creation of instantiated unions. They're now all byte arrays. size_is_one = false; type = char_type2(); } unsigned int &dynamic_counter = get_dynamic_counter(); dynamic_counter++; // value symbolt symbol; symbol.base_name = "dynamic_" + i2string(dynamic_counter) + (size_is_one ? "_value" : "_array"); symbol.name = "symex_dynamic::" + id2string(symbol.base_name); symbol.lvalue = true; typet renamedtype = ns.follow(migrate_type_back(type)); if(size_is_one) symbol.type=renamedtype; else { symbol.type=typet(typet::t_array); symbol.type.subtype()=renamedtype; symbol.type.size(migrate_expr_back(size)); } symbol.type.dynamic(true); symbol.mode="C"; new_context.add(symbol); type2tc new_type; migrate_type(symbol.type, new_type); address_of2tc rhs_addrof(get_empty_type(), expr2tc()); if(size_is_one) { rhs_addrof.get()->type = get_pointer_type(pointer_typet(symbol.type)); rhs_addrof.get()->ptr_obj = symbol2tc(new_type, symbol.name); } else { type2tc subtype; migrate_type(symbol.type.subtype(), subtype); expr2tc sym = symbol2tc(new_type, symbol.name); expr2tc idx_val = zero_ulong; expr2tc idx = index2tc(subtype, sym, idx_val); rhs_addrof.get()->type = get_pointer_type(pointer_typet(symbol.type.subtype())); rhs_addrof.get()->ptr_obj = idx; } expr2tc rhs = rhs_addrof; expr2tc ptr_rhs = rhs; if (!options.get_bool_option("force-malloc-success")) { symbol2tc null_sym(rhs->type, "NULL"); sideeffect2tc choice(get_bool_type(), expr2tc(), expr2tc(), std::vector<expr2tc>(), type2tc(), sideeffect2t::nondet); rhs = if2tc(rhs->type, choice, rhs, null_sym); replace_nondet(rhs); ptr_rhs = rhs; } if (rhs->type != lhs->type) rhs = typecast2tc(lhs->type, rhs); cur_state->rename(rhs); expr2tc rhs_copy(rhs); guardt guard; symex_assign_rec(lhs, rhs, guard); pointer_object2tc ptr_obj(pointer_type2(), ptr_rhs); track_new_pointer(ptr_obj, new_type); dynamic_memory.push_back(allocated_obj(rhs_copy, cur_state->guard, !is_malloc)); return rhs_addrof->ptr_obj; }
void goto_symext::symex_realloc(const expr2tc &lhs, const sideeffect2t &code) { expr2tc src_ptr = code.operand; expr2tc realloc_size = code.size; internal_deref_items.clear(); dereference2tc deref(get_empty_type(), src_ptr); dereference(deref, dereferencet::INTERNAL); // src_ptr is now invalidated. // Free the given pointer. This just uses the pointer object from the pointer // variable that's the argument to realloc. It also leads to pointer validity // checking, and checks that the offset is zero. code_free2tc fr(code.operand); symex_free(fr); // We now have a list of things to work on. Recurse into them, build a result, // and then switch between those results afterwards. // Result list is the address of the reallocated piece of data, and the guard. std::list<std::pair<expr2tc, expr2tc>> result_list; for(auto &item : internal_deref_items) { expr2tc guard = item.guard; cur_state->rename_address(item.object); cur_state->guard.guard_expr(guard); target->renumber(guard, item.object, realloc_size, cur_state->source); type2tc new_ptr = type2tc(new pointer_type2t(item.object->type)); address_of2tc addrof(new_ptr, item.object); result_list.emplace_back(addrof, item.guard); // Bump the realloc-numbering of the object. This ensures that, after // renaming, the address_of we just generated compares differently to // previous address_of's before the realloc. unsigned int cur_num = 0; if(cur_state->realloc_map.find(item.object) != cur_state->realloc_map.end()) { cur_num = cur_state->realloc_map[item.object]; } cur_num++; std::map<expr2tc, unsigned>::value_type v(item.object, cur_num); cur_state->realloc_map.insert(v); } // Rebuild a gigantic if-then-else chain from the result list. expr2tc result; if(result_list.size() == 0) { // Nothing happened; there was nothing, or only null, to point at. // In this case, just return right now and leave the pointer free. The // symex_free that occurred above should trigger a dereference failure. return; } result = expr2tc(); for(auto const &it : result_list) { if(is_nil_expr(result)) result = it.first; else result = if2tc(result->type, it.second, it.first, result); } // Install pointer modelling data into the relevant arrays. pointer_object2tc ptr_obj(pointer_type2(), result); track_new_pointer(ptr_obj, type2tc(), realloc_size); symex_assign(code_assign2tc(lhs, result), true); }
void goto_symext::symex_other() { const goto_programt::instructiont &instruction = *cur_state->source.pc; expr2tc code2 = instruction.code; if(is_code_expression2t(code2)) { // Represents an expression that gets evaluated, but does not have any // other effect on execution, i.e. doesn't contain a call or assignment. // This can, however, cause the program to fail if it dereferences an // invalid pointer. Therefore, dereference it. const code_expression2t &expr = to_code_expression2t(code2); expr2tc operand = expr.operand; dereference(operand, dereferencet::READ); } else if(is_code_cpp_del_array2t(code2) || is_code_cpp_delete2t(code2)) { expr2tc deref_code(code2); replace_dynamic_allocation(deref_code); replace_nondet(deref_code); dereference(deref_code, dereferencet::READ); symex_cpp_delete(deref_code); } else if(is_code_free2t(code2)) { symex_free(code2); } else if(is_code_printf2t(code2)) { replace_dynamic_allocation(code2); replace_nondet(code2); dereference(code2, dereferencet::READ); symex_printf(expr2tc(), code2); } else if(is_code_decl2t(code2)) { replace_dynamic_allocation(code2); replace_nondet(code2); dereference(code2, dereferencet::READ); const code_decl2t &decl_code = to_code_decl2t(code2); // just do the L2 renaming to preseve locality const irep_idt &identifier = decl_code.value; // Generate dummy symbol as a vehicle for renaming. symbol2tc l1_sym(get_empty_type(), identifier); cur_state->top().level1.get_ident_name(l1_sym); symbol2t &l1_symbol = to_symbol2t(l1_sym); // increase the frame if we have seen this declaration before while(cur_state->top().declaration_history.find( renaming::level2t::name_record(l1_symbol)) != cur_state->top().declaration_history.end()) { unsigned &index = cur_state->variable_instance_nums[identifier]; cur_state->top().level1.rename(l1_sym, ++index); l1_symbol.level1_num = index; } renaming::level2t::name_record tmp_name(l1_symbol); cur_state->top().declaration_history.insert(tmp_name); cur_state->top().local_variables.insert(tmp_name); // seen it before? // it should get a fresh value if(cur_state->level2.current_number(l1_sym) != 0) { // Dummy assignment - blank constant value isn't considered for const // propagation, variable number will be bumped to result in a new free // variable. Invalidates l1_symbol reference? cur_state->level2.make_assignment(l1_sym, expr2tc(), expr2tc()); } } else if(is_code_asm2t(code2)) { // Assembly statement -> do nothing. return; } else throw "goto_symext: unexpected statement: " + get_expr_id(code2); }