Example: provenance_basic_auto_yx.c

up: index
prev: provenance_basic_auto_xy.c
next: cheri_03_ii.c

1
2
3
4
5
6
7
8
9
10
11
12

    #include <stdio.h>
    #include <string.h> 
    int main() {
      int y=2, x=1;
      int *p = &x + 1;
      int *q = &y;
      printf("Addresses: p=%p q=%p\n",(void*)p,(void*)q);
      if (memcmp(&p, &q, sizeof(p)) == 0) {
        *p = 11;  // does this have undefined behaviour?
        printf("x=%d y=%d *p=%d *q=%d\n",x,y,*p,*q);
      }
    }
[link to run test in Cerberus]

Experimental data (what does this mean?) 



cerberus-concrete-PVI-plain Undefined behaviour: out of bounds pointer at memory store at 9:5-12


cerberus-concrete-PVI-ae Undefined behaviour: out of bounds pointer at memory store at 9:5-12


cerberus-concrete-PVI-ae-udi Undefined behaviour: out of bounds pointer at memory store at 9:5-12


gcc-8.3-O0 Addresses: p=0x7ffeefbff32c q=0x7ffeefbff32c
x=1 y=11 *p=11 *q=11


gcc-8.3-O2 Addresses: p=0x7ffeefbff320 q=0x7ffeefbff318


gcc-8.3-O3 Addresses: p=0x7ffeefbff320 q=0x7ffeefbff318


gcc-8.3-O2-no-strict-aliasing Addresses: p=0x7ffeefbff2e0 q=0x7ffeefbff2d8


gcc-8.3-O3-no-strict-aliasing Addresses: p=0x7ffeefbff2e0 q=0x7ffeefbff2d8


clang-7.0.1-O0 Addresses: p=0x7ffeefbff318 q=0x7ffeefbff318
x=1 y=11 *p=11 *q=11


clang-7.0.1-O2 Addresses: p=0x7ffeefbff310 q=0x7ffeefbff308


clang-7.0.1-O3 Addresses: p=0x7ffeefbff310 q=0x7ffeefbff308


clang-7.0.1-O2-no-strict-aliasing Addresses: p=0x7ffeefbff2d0 q=0x7ffeefbff2c8


clang-7.0.1-O3-no-strict-aliasing Addresses: p=0x7ffeefbff2d0 q=0x7ffeefbff2c8


icc-19-O0 Addresses: p=0x7fffffffe6b8 q=0x7fffffffe6b0


icc-19-O2 Addresses: p=0x6046c4 q=0x6046c4
x=1 y=2 *p=11 *q=11


icc-19-O3 Addresses: p=0x6046c4 q=0x6046c4
x=1 y=2 *p=11 *q=11


icc-19-O2-no-strict-aliasing Addresses: p=0x6046c4 q=0x6046c4
x=1 y=2 *p=11 *q=11


icc-19-O3-no-strict-aliasing Addresses: p=0x6046c4 q=0x6046c4
x=1 y=2 *p=11 *q=11