Module BO__BufferOverrunDomain.AliasTarget

type alias_typ =
| Eq

The value of alias target is exactly the same to the alias key.

| Le

The value of alias target is less than or equal to the alias key. For example, if there is an alias between %r and size(x)+i with the Le type, it means size(x)+i <= %r.

type t =
| Simple of {
i : IR.IntLit.t;
java_tmp : BO.AbsLoc.Loc.t option;
}

Since Sil distinguishes logical and program variables, we need a relation for pruning values of program variables. For example, a C statement if(x){...} is translated to %r=load(x); if(%r){...} in Sil. At the load statement, we record the alias between the values of %r and x, then we can prune not only the value of %r, but also that of x inside the if branch. The java_tmp field is an additional slot for keeping one more alias of temporary variable in Java. The i field is to express %r=load(x)+i.

| Empty

For pruning vector.length with vector::empty() results, we adopt a specific relation between %r and v->elements, where %r=v.empty(). So, if %r!=0, v's array length (v->elements->length) is pruned by =0. On the other hand, if %r==0, v's array length is pruned by >=1.

| Size of {
alias_typ : alias_typ;
i : IR.IntLit.t;
java_tmp : BO.AbsLoc.Loc.t option;
}

This is for pruning vector's length. When there is a function call, %r=x.size(), the alias target for %r becomes AliasTarget.size {l=x.elements}. The java_tmp field is an additional slot for keeping one more alias of temporary variable in Java. The i field is to express %r=x.size()+i, which is required to follow the semantics of Array.add inside loops precisely.

| Fgets

This is for pruning return values of fgets. If the result of fgets is not null, the length of return value will be pruned to greater than or equal to 1.

| IteratorSimple of {
i : IR.IntLit.t;
java_tmp : BO.AbsLoc.Loc.t option;
}

This is for tracking a relation between an iterator offset and an integer value. If %r has an alias to IteratorSimple {l; i}, which means that %r's iterator offset is same to l.

| IteratorOffset of {
alias_typ : alias_typ;
i : IR.IntLit.t;
java_tmp : BO.AbsLoc.Loc.t option;
}

This is for tracking a relation between an iterator offset and the length of the underlying collection. If %r has an alias to IteratorOffset {l; i}, which means that %r's iterator offset is same to length(l)+i.

| IteratorHasNext of {
java_tmp : BO.AbsLoc.Loc.t option;
}

This is for tracking return values of the hasNext function. If %r has an alias to HasNext {l}, which means that %r is same to l.hasNext().

| IteratorNextObject of {
objc_tmp : BO.AbsLoc.Loc.t option;
}

This is for tracking the return values of nextObject function. If %r has an alias to nextObject {l}, which means that %r is the same to l.nextObject().

| Top

Relations between values of logical variables(registers) and program variables

include Absint.AbstractDomain.S with type t := t
include Absint.AbstractDomain.NoJoin
include IStdlib.PrettyPrintable.PrintableType
type t
val pp : IStdlib.PrettyPrintable.F.formatter -> t -> unit
val leq : lhs:t -> rhs:t -> bool

the implication relation: lhs <= rhs means lhs |- rhs

val join : t -> t -> t
val widen : prev:t -> next:t -> num_iters:int -> t
val equal : t -> t -> bool