Example: pointer_copy_user_ctrlflow_bitwise.c

up: index
prev: pointer_copy_user_ctrlflow_bytewise.c
next: provenance_equality_uintptr_t_global_xy.c

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

    #include <stdio.h>
    #include <inttypes.h>
    #include <limits.h>
    int x=1;
    int main() {
      int *p = &x;
      uintptr_t i = (uintptr_t)p;
      int uintptr_t_width = sizeof(uintptr_t) * CHAR_BIT;
      uintptr_t bit, j;
      int k;
      j=0;
      for (k=0; k<uintptr_t_width; k++) {
        bit = (i & (((uintptr_t)1) << k)) >> k;
        if (bit == 1) 
          j = j | ((uintptr_t)1 << k);
        else
          j = j;
      }
      int *q = (int *)j;
      *q = 11; // is this free of undefined behaviour?
      printf("*p=%d  *q=%d\n",*p,*q);  
    }
[link to run test in Cerberus]

Experimental data (what does this mean?) 



cerberus-concrete-PVI Undefined behaviour: the operand of the unary '*' operator has an invalid value at 20:3-5


cerberus-concrete-PNVI *p=11  *q=11


gcc-8.1-O0 *p=11  *q=11


gcc-8.1-O2 *p=11  *q=11


gcc-8.1-O3 *p=11  *q=11


gcc-8.1-O2-no-strict-aliasing *p=11  *q=11


gcc-8.1-O3-no-strict-aliasing *p=11  *q=11


clang-6.0-O0 pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


clang-6.0-O2 pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


clang-6.0-O3 pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


clang-6.0-O2-no-strict-aliasing pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


clang-6.0-O3-no-strict-aliasing pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


clang-6.0-UBSAN pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


clang-6.0-ASAN pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


clang-6.0-MSAN pointer_copy_user_ctrlflow_bitwise.c:17:9: warning: explicitly assigning value of variable of type 'uintptr_t' (aka 'unsigned long') to itself [-Wself-assign]
      j = j;
      ~ ^ ~
1 warning generated.
*p=11  *q=11


icc-19-O0 *p=11  *q=11


icc-19-O2 *p=11  *q=11


icc-19-O3 *p=11  *q=11


icc-19-O2-no-strict-aliasing *p=11  *q=11


icc-19-O3-no-strict-aliasing *p=11  *q=11


compcert-3.4 *p=11  *q=11


compcert-3.4-O *p=11  *q=11


kcc-1.0 exit codes: compile 0 / execute 139
Comparison of unspecified value:
      > in main at pointer_copy_user_ctrlflow_bitwise.c:14:5

    Unspecified value or behavior (USP-CERL7):
        see C11 section 6.5.9 http://rvdoc.org/C11/6.5.9
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1

Conversion from an integer to non-null pointer:
      > in main at pointer_copy_user_ctrlflow_bitwise.c:19:3

    Implementation defined behavior (IMPL-CCV13):
        see C11 section 6.3.2.3:5 http://rvdoc.org/C11/6.3.2.3
        see CERT section INT36-C http://rvdoc.org/CERT/INT36-C