Example: pointer_copy_user_dataflow_direct_bytewise.c

up: index
prev: pointer_copy_memcpy.c
next: pointer_copy_user_ctrlflow_bytewise.c

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

    #include <stdio.h>
    #include <string.h>
    int  x=1;
    void user_memcpy(unsigned char* dest, 
                     unsigned char *src, size_t n) {
      while (n > 0)  {      
        *dest = *src;
        src += 1; dest += 1; n -= 1;
      }
    }
    int main() {
      int *p = &x;
      int *q;
      user_memcpy((unsigned char*)&q, 
                  (unsigned char*)&p, sizeof(int *));
      *q = 11; // is this free of undefined behaviour?
      printf("*p=%d  *q=%d\n",*p,*q);
    }
[link to run test in Cerberus]

Experimental data (what does this mean?) 



cerberus-concrete-PVI *p=11  *q=11


cerberus-concrete-PNVI *p=11  *q=11


gcc-8.1-O0 *p=11  *q=11


gcc-8.1-O2 *p=11  *q=11


gcc-8.1-O3 *p=11  *q=11


gcc-8.1-O2-no-strict-aliasing *p=11  *q=11


gcc-8.1-O3-no-strict-aliasing *p=11  *q=11


clang-6.0-O0 *p=11  *q=11


clang-6.0-O2 *p=11  *q=11


clang-6.0-O3 *p=11  *q=11


clang-6.0-O2-no-strict-aliasing *p=11  *q=11


clang-6.0-O3-no-strict-aliasing *p=11  *q=11


clang-6.0-UBSAN *p=11  *q=11


clang-6.0-ASAN *p=11  *q=11


clang-6.0-MSAN *p=11  *q=11


icc-19-O0 *p=11  *q=11


icc-19-O2 *p=11  *q=11


icc-19-O3 *p=11  *q=11


icc-19-O2-no-strict-aliasing *p=11  *q=11


icc-19-O3-no-strict-aliasing *p=11  *q=11


compcert-3.4 *p=11  *q=11


compcert-3.4-O *p=11  *q=11


kcc-1.0 *p=11  *q=11