Fix crash in shadow memory operations with zero-sized types#8894
Open
tautschnig wants to merge 1 commit intodiffblue:developfrom
Open
Fix crash in shadow memory operations with zero-sized types#8894tautschnig wants to merge 1 commit intodiffblue:developfrom
tautschnig wants to merge 1 commit intodiffblue:developfrom
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #8894 +/- ##
===========================================
- Coverage 80.41% 80.41% -0.01%
===========================================
Files 1703 1703
Lines 188398 188405 +7
Branches 73 73
===========================================
- Hits 151502 151501 -1
- Misses 36896 36904 +8 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
When shadow memory operations process structs containing zero-sized type (ZST) members, the or_values helper could be called with an empty operand list, creating an invalid bitor expression with zero operands that crashes the solver. Similarly, compute_max_over_bytes would call create_max_expr with an empty vector. - Return default value (zero) from or_values for empty operand lists - Skip zero-sized components in compute_or_over_bytes - Return default value from compute_max_over_bytes for zero-byte types The regression test uses empty structs which are a GCC extension not accepted in MSVC mode, so the test is marked gcc-only. Fixes: diffblue#8284 Co-authored-by: Kiro <kiro-agent@users.noreply.github.com>
9d2cd29 to
0a3e8d5
Compare
There was a problem hiding this comment.
Pull request overview
Fixes a CBMC crash when aggregating shadow-memory values over zero-sized types (ZSTs), ensuring shadow-memory get operations return a well-defined default instead of creating invalid zero-width/empty-operand bitvector expressions.
Changes:
- Return a default zero value when aggregating over an empty set of values (e.g., structs whose non-padding components are all ZSTs).
- Skip zero-sized struct/union components during boolean aggregation to avoid generating invalid expressions.
- Add a regression test covering nested/only-ZST structs and shadow-memory get/set scenarios that previously triggered solver invariant violations.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/goto-symex/shadow_memory_util.cpp |
Avoids constructing invalid aggregation expressions for ZST/empty-byte cases by skipping ZST components and returning a default zero value when there are no bytes/operands. |
regression/cbmc-shadow-memory/zero-sized-types/test.desc |
Adds a new regression test configuration (gcc-only) validating successful verification and guarding against warnings. |
regression/cbmc-shadow-memory/zero-sized-types/main.c |
Exercises shadow-memory operations over structs containing ZST fields (including nested and only-ZST cases) to prevent regressions of the crash. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: #8284