<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<font class="Apple-style-span" face="Monaco">Jordy,</font><div><font class="Apple-style-span" face="Monaco"> using "L" for the value of strlen(),</font></div><div><font class="Apple-style-span" face="Monaco">and "min(L,10)" for the value of strnlen(,10)</font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco">in general we know</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" face="Monaco"> </font></span><font class="Apple-style-span" face="Monaco">L >= 0</font></div><div><font class="Apple-style-span" face="Monaco">in the then-clause of the if-statement we know this additional relation</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" face="Monaco"> </font></span><font class="Apple-style-span" face="Monaco">min(L,10) != L</font></div><div><font class="Apple-style-span" face="Monaco">from which a good algebraic system might choose to simplify to</font></div><div><font class="Apple-style-span" face="Monaco"> L > 10</font></div><div><font class="Apple-style-span" face="Monaco">and that's about all. its a constraint, not a value.</font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco">I am guessing you already knew that, and your post results from the</font></div><div><font class="Apple-style-span" face="Monaco">static analyzer trying use a different form of reasoning, a different</font></div><div><font class="Apple-style-span" face="Monaco">algorithm. But I believe the above is the most mathematically complete</font></div><div><font class="Apple-style-span" face="Monaco">information that can be derived from the situation, anything else (like</font></div><div><font class="Apple-style-span" face="Monaco">"conjured values", what ever that means) will necessarily involve</font></div><div><font class="Apple-style-span" face="Monaco">creating and propagating false information.</font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco">for the second example, being after the first if-statement is like being</font></div><div><font class="Apple-style-span" face="Monaco">in its else-clause, so we have</font></div><div><font class="Apple-style-span" face="Monaco"> min(L,10) >= 5</font></div><div><font class="Apple-style-span" face="Monaco">again a good algebraic system might want to simplify this to</font></div><div><font class="Apple-style-span" face="Monaco"> L >= 5</font></div><div><font class="Apple-style-span" face="Monaco">feeding that into the second if-statement conditional we get</font></div><div><font class="Apple-style-span" face="Monaco"><span class="Apple-tab-span" style="white-space:pre"> </span>min( (L >= 5), 10 ) < 5</font></div><div><font class="Apple-style-span" face="Monaco">which a good algebraic system should evaluate to false, which</font></div><div><font class="Apple-style-span" face="Monaco">should eliminate the false-positive null-pointer warning. Notice that</font></div><div><font class="Apple-style-span" face="Monaco">this conclusion is arrived at without any "conjured values" (whatever that</font></div><div><font class="Apple-style-span" face="Monaco">means).</font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco">but that is only if your system propagates "constraints", not just "values",</font></div><div><font class="Apple-style-span" face="Monaco">and as I have spent most of my recent past working with llvm-ir rather</font></div><div><font class="Apple-style-span" face="Monaco">than clang, I await your enlightened response...</font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><font class="Apple-style-span" face="Monaco">sincerely,</font></div><div><font class="Apple-style-span" face="Monaco">Peter Lawrence.</font></div><div><font class="Apple-style-span" face="Monaco"><br></font></div><div><br><div><div>On Jun 4, 2011, at 10:00 AM, <a href="mailto:cfe-dev-request@cs.uiuc.edu">cfe-dev-request@cs.uiuc.edu</a> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">------------------------------</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Message: 2</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Date: Fri, 3 Jun 2011 16:45:14 -0700</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">From: Jordy Rose <<a href="mailto:jediknil@belkadan.com">jediknil@belkadan.com</a>></font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Subject: [cfe-dev] Fixes for strnlen() in CStringChecker</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Cc: <a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a></font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Message-ID: <<a href="mailto:4486B9B8-A35C-4266-A396-A3DB1518A567@belkadan.com">4486B9B8-A35C-4266-A396-A3DB1518A567@belkadan.com</a>></font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Content-Type: text/plain; charset="us-ascii"</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">[originally to Lenny and Ted]</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">So I started cleaning up strLengthCommon() in CStringChecker and ran into a problem concerning strnlen(). The code that's in there now handles the case where the limit argument is less than the string length, and works when it's greater. But when you can't say either with certainty, it's returning the string length by default right now. That then allows mistaken assumptions about the length of the string from then on.</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Basically, this test fails:</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">void strnlen_is_not_strlen(char *x) {</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco"><span class="Apple-converted-space"> </span>if (strnlen(x, 10) != strlen(x))</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco"><span class="Apple-converted-space"> </span>(void)*(char*)0; // expected-warning{{null}}</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">}</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">The problem is, fixing this breaks a number of other tests, like this one:</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">void strnlen_liveness(const char *x) {</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco"><span class="Apple-converted-space"> </span>if (strnlen(x, 10) < 5)</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco"><span class="Apple-converted-space"> </span>return;</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco"><span class="Apple-converted-space"> </span>if (strnlen(x, 10) < 5)</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco"><span class="Apple-converted-space"> </span>(void)*(char*)0; // no-warning</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">}</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">This is because this tells us nothing about the actual length of x, and we get two independent conjured values here. I don't know how we'd want to go about fixing this, or if we should at all.</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Attached: the patch, including the new tests but without removing the now-broken ones. What's the best thing to do here?</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">Jordy</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Monaco; min-height: 16.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Monaco" size="3" style="font: 12.0px Monaco">-------------- next part --------------</font></p> </blockquote></div><br></div></body></html>