Example: pointer_copy_user_dataflow_direct_bytewise.c

up: index
prev: pointer_copy_memcpy.c
next: provenance_tag_bits_via_repr_byte_1.c

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

    #include <stdio.h>
    #include <string.h>
    int  x=1;
    void user_memcpy(unsigned char* dest, 
                     unsigned char *src, size_t n) {
      while (n > 0)  {      
        *dest = *src;
        src += 1; dest += 1; n -= 1;
      }
    }
    int main() {
      int *p = &x;
      int *q;
      user_memcpy((unsigned char*)&q, 
                  (unsigned char*)&p, sizeof(int *));
      *q = 11; // is this free of undefined behaviour?
      printf("*p=%d  *q=%d\n",*p,*q);
    }
[link to run test in Cerberus]

Experimental data (what does this mean?) 



cerberus-concrete-PVI-plain *p=11  *q=11


cerberus-concrete-PVI-ae *p=11  *q=11


cerberus-concrete-PVI-ae-udi *p=11  *q=11


gcc-8.3-O0 *p=11  *q=11


gcc-8.3-O2 *p=11  *q=11


gcc-8.3-O3 *p=11  *q=11


gcc-8.3-O2-no-strict-aliasing *p=11  *q=11


gcc-8.3-O3-no-strict-aliasing *p=11  *q=11


clang-7.0.1-O0 *p=11  *q=11


clang-7.0.1-O2 *p=11  *q=11


clang-7.0.1-O3 *p=11  *q=11


clang-7.0.1-O2-no-strict-aliasing *p=11  *q=11


clang-7.0.1-O3-no-strict-aliasing *p=11  *q=11


icc-19-O0 *p=11  *q=11


icc-19-O2 *p=11  *q=11


icc-19-O3 *p=11  *q=11


icc-19-O2-no-strict-aliasing *p=11  *q=11


icc-19-O3-no-strict-aliasing *p=11  *q=11