Example: provenance_basic_global_yx.c

up: index
prev: provenance_basic_global_xy.c
next: provenance_basic_auto_xy.c

1
2
3
4
5
6
7
8
9
10
11
12

    #include <stdio.h>
    #include <string.h> 
    int y=2, x=1;
    int main() {
      int *p = &x + 1;
      int *q = &y;
      printf("Addresses: p=%p q=%p\n",(void*)p,(void*)q);
      if (memcmp(&p, &q, sizeof(p)) == 0) {
        *p = 11;  // does this have undefined behaviour?
        printf("x=%d y=%d *p=%d *q=%d\n",x,y,*p,*q);
      }
    }
[link to run test in Cerberus]

Experimental data (what does this mean?) 



cerberus-concrete-PVI Addresses: p=(@6, 0x50) q=(@5, 0x48)


cerberus-concrete-PNVI Addresses: p=(@6, 0x50) q=(@5, 0x48)


gcc-8.1-O0 Addresses: p=0x600a30 q=0x600a28


gcc-8.1-O2 Addresses: p=0x6009c4 q=0x6009c4
x=1 y=2 *p=11 *q=2


gcc-8.1-O3 Addresses: p=0x6009c4 q=0x6009c4
x=1 y=2 *p=11 *q=2


gcc-8.1-O2-no-strict-aliasing Addresses: p=0x6009c4 q=0x6009c4
x=1 y=2 *p=11 *q=2


gcc-8.1-O3-no-strict-aliasing Addresses: p=0x6009c4 q=0x6009c4
x=1 y=2 *p=11 *q=2


clang-6.0-O0 Addresses: p=0x601040 q=0x601038


clang-6.0-O2 Addresses: p=0x601040 q=0x601038


clang-6.0-O3 Addresses: p=0x601040 q=0x601038


clang-6.0-O2-no-strict-aliasing Addresses: p=0x601040 q=0x601038


clang-6.0-O3-no-strict-aliasing Addresses: p=0x601040 q=0x601038


clang-6.0-UBSAN Addresses: p=0x631b58 q=0x631b50


clang-6.0-ASAN Addresses: p=0x716ba4 q=0x716b60


clang-6.0-MSAN Addresses: p=0x6b7af8 q=0x6b7af0


icc-19-O0 Addresses: p=0x600b60 q=0x600b58


icc-19-O2 Addresses: p=0x6046c8 q=0x6046c0


icc-19-O3 Addresses: p=0x6046c8 q=0x6046c0


icc-19-O2-no-strict-aliasing Addresses: p=0x6046c8 q=0x6046c0


icc-19-O3-no-strict-aliasing Addresses: p=0x6046c8 q=0x6046c0


compcert-3.4 Addresses: p=0x601048 q=0x601040


compcert-3.4-O Addresses: p=0x601048 q=0x601040


kcc-1.0 Addresses: p=(nil) q=(nil)
x=1 y=2 *p=0 *q=2
Comparison of unspecified value:
      > in memcmp at /opt/rv-match/c-semantics/profiles/x86_64-linux-gcc-glibc/src/string.c:180:13
        in main at provenance_basic_global_yx.c:8:3

    Unspecified value or behavior (USP-CERL7):
        see C11 section 6.5.9 http://rvdoc.org/C11/6.5.9
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1

Dereferencing a pointer past the end of an array:
      > in main at provenance_basic_global_yx.c:9:5

    Undefined behavior (UB-CER4):
        see C11 section 6.5.6:8 http://rvdoc.org/C11/6.5.6
        see C11 section J.2:1 items 47 and 49 http://rvdoc.org/C11/J.2
        see CERT-C section ARR30-C http://rvdoc.org/CERT-C/ARR30-C
        see CERT-C section ARR37-C http://rvdoc.org/CERT-C/ARR37-C
        see CERT-C section STR31-C http://rvdoc.org/CERT-C/STR31-C
        see MISRA-C section 8.18:1 http://rvdoc.org/MISRA-C/8.18
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1

Trying to write outside the bounds of an object:
      > in main at provenance_basic_global_yx.c:9:5

    Undefined behavior (UB-EIO2):
        see C11 section 6.5.6:8 http://rvdoc.org/C11/6.5.6
        see C11 section J.2:1 items 47 and 49 http://rvdoc.org/C11/J.2
        see CERT-C section ARR30-C http://rvdoc.org/CERT-C/ARR30-C
        see CERT-C section ARR37-C http://rvdoc.org/CERT-C/ARR37-C
        see CERT-C section MEM35-C http://rvdoc.org/CERT-C/MEM35-C
        see CERT-C section STR31-C http://rvdoc.org/CERT-C/STR31-C
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1

Dereferencing a pointer past the end of an array:
      > in main at provenance_basic_global_yx.c:10:5

    Undefined behavior (UB-CER4):
        see C11 section 6.5.6:8 http://rvdoc.org/C11/6.5.6
        see C11 section J.2:1 items 47 and 49 http://rvdoc.org/C11/J.2
        see CERT-C section ARR30-C http://rvdoc.org/CERT-C/ARR30-C
        see CERT-C section ARR37-C http://rvdoc.org/CERT-C/ARR37-C
        see CERT-C section STR31-C http://rvdoc.org/CERT-C/STR31-C
        see MISRA-C section 8.18:1 http://rvdoc.org/MISRA-C/8.18
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1

Reading outside the bounds of an object:
      > in main at provenance_basic_global_yx.c:10:5

    Undefined behavior (UB-EIO7):
        see C11 section 6.3.2.1:1 http://rvdoc.org/C11/6.3.2.1
        see C11 section J.2:1 item 19 http://rvdoc.org/C11/J.2
        see CERT-C section ARR30-C http://rvdoc.org/CERT-C/ARR30-C
        see CERT-C section ARR37-C http://rvdoc.org/CERT-C/ARR37-C
        see CERT-C section STR31-C http://rvdoc.org/CERT-C/STR31-C
        see CERT-C section STR32-C http://rvdoc.org/CERT-C/STR32-C
        see MISRA-C section 8.1:3 http://rvdoc.org/MISRA-C/8.1