eurecom-s3 / symcc

SymCC: efficient compiler-based symbolic execution

Home Page:http://www.s3.eurecom.fr/tools/symbolic_execution/symcc.html

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Confusion of single-bits values and booleans for C type `_Bool`

gernst opened this issue · comments

The following program trips up handling of single-bit values vs booleans in the backend, such a single-bit value can be passed either as test to _sym_build_bool_to_bits or as constraint _sym_push_path_constraint, instead of a proper boolean value.

It is clearly related to type _Bool (which is part of the C standard, from stdbool.h), replacing _Bool by an integer type solves the problem.

_Bool __VERIFIER_nondet_bool() {
    char x = 0;
    read_symbolized(0, &x, sizeof(x));
    _Bool y = x >=0;
    return y;
}

int main() {
    _Bool x = __VERIFIER_nondet_bool();

    if(x) return 0;
    else return 1;
}

This effectively leads to a type error, e.g., in the simple backend:

Sort mismatch at argument #1 for function (declare-fun ite (Bool (_ BitVec 8) (_ BitVec 8)) (_ BitVec 8)) supplied sort is (_ BitVec 1)
simple: /home/ernst/tools/symcc/runtime/simple_backend/Runtime.cpp:78: void {anonymous}::handle_z3_error(Z3_context, Z3_error_code): Assertion `!"Z3 error"' failed.