cerc-io/solidity
11
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Report out of bounds index access

Browse Source
This commit is contained in:
Leonardo Alt
2021-03-30 10:28:48 +02:00
parent 2346ec1c0c
commit dbd067d6db
208 changed files with 1619 additions and 608 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/libsolidity/smtCheckerTests/abi/abi_decode_array.sol
+11 -8
View File
@@ -18,6 +18,9 @@ contract C {
assert(e.length == g.length); // should fail
(uint[][] memory h, uint[][][] memory i, uint j) = abi.decode(b1, (uint[][], uint[][][], uint));
require(j < h.length);
require(j < i.length);
require(j < i[j].length);
assert(h[j].length == i[j][j].length); // should fail
(uint[] memory k, uint[] memory l) = abi.decode(b2, (uint[], uint[]));
@@ -39,18 +42,18 @@ contract C {
// Warning 8364: (811-817): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (811-819): Assertion checker does not yet implement type type(uint256[] memory[] memory)
// Warning 8364: (811-821): Assertion checker does not yet implement type type(uint256[] memory[] memory[] memory)
// Warning 8364: (943-949): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (951-957): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (1021-1027): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (1029-1035): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 6328: (214-242): CHC: Assertion violation happens here.
// Warning 6328: (367-395): CHC: Assertion violation happens here.
// Warning 6328: (446-474): CHC: Assertion violation happens here.
// Warning 6328: (592-620): CHC: Assertion violation happens here.
// Warning 6328: (639-667): CHC: Assertion violation happens here.
// Warning 6328: (686-714): CHC: Assertion violation happens here.
// Warning 6328: (833-870): CHC: Assertion violation happens here.
// Warning 6328: (963-991): CHC: Assertion violation happens here.
// Warning 6328: (1010-1038): CHC: Assertion violation happens here.
// Warning 6328: (1057-1085): CHC: Assertion violation happens here.
// Warning 6328: (911-948): CHC: Assertion violation happens here.
// Warning 6328: (1041-1069): CHC: Assertion violation happens here.
// Warning 6328: (1088-1116): CHC: Assertion violation happens here.
// Warning 6328: (1135-1163): CHC: Assertion violation happens here.
// Warning 8364: (194-200): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (202-208): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (315-321): Assertion checker does not yet implement type type(uint256[] memory)
@@ -63,5 +66,5 @@ contract C {
// Warning 8364: (811-817): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (811-819): Assertion checker does not yet implement type type(uint256[] memory[] memory)
// Warning 8364: (811-821): Assertion checker does not yet implement type type(uint256[] memory[] memory[] memory)
// Warning 8364: (943-949): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (951-957): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (1021-1027): Assertion checker does not yet implement type type(uint256[] memory)
// Warning 8364: (1029-1035): Assertion checker does not yet implement type type(uint256[] memory)
test/libsolidity/smtCheckerTests/array_members/length_1d_assignment_2d_memory_to_memory.sol
+1
View File
@@ -3,6 +3,7 @@ pragma abicoder v2;
contract C {
function f(uint[][] memory arr) public pure {
require(arr.length > 0);
uint[][] memory arr2 = arr;
assert(arr2[0].length == arr[0].length);
assert(arr.length == arr2.length);
test/libsolidity/smtCheckerTests/array_members/length_1d_assignment_2d_storage_to_storage.sol
+6
View File
@@ -4,6 +4,12 @@ pragma abicoder v2;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr2.push();
arr2.push();
}
function f() public view {
assert(arr2[0].length == arr[0].length);
assert(arr2.length == arr.length);
test/libsolidity/smtCheckerTests/array_members/length_1d_copy_2d_memory_to_storage.sol
+1
View File
@@ -4,6 +4,7 @@ pragma abicoder v2;
contract C {
uint[][] arr;
function f(uint[][] memory arr2) public {
require(arr2.length > 0);
arr = arr2;
assert(arr2[0].length == arr[0].length);
assert(arr2.length == arr.length);
test/libsolidity/smtCheckerTests/array_members/length_1d_copy_2d_storage_to_memory.sol
+6
View File
@@ -3,6 +3,12 @@ pragma abicoder v2;
contract C {
uint[][] arr;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public view {
uint[][] memory arr2 = arr;
assert(arr2[0].length == arr[0].length);
test/libsolidity/smtCheckerTests/array_members/length_1d_mapping_array_2d_1.sol
+2 -1
View File
@@ -2,8 +2,9 @@ pragma experimental SMTChecker;
contract C {
mapping (uint => uint[][]) map;
function f(uint x, uint y) public view {
function f(uint x, uint y) public {
require(x == y);
map[x].push();
assert(map[x][0].length == map[y][0].length);
}
}
test/libsolidity/smtCheckerTests/array_members/length_1d_struct_array_2d_1.sol
+10 -1
View File
@@ -6,8 +6,17 @@ contract C {
}
S s1;
S s2;
constructor() {
s1.arr.push();
s2.arr.push();
s1.arr[0].push();
s1.arr[0].push();
s1.arr[0].push();
s2.arr[0].push();
s2.arr[0].push();
s2.arr[0].push();
}
function f() public view {
assert(s1.arr[0].length == s2.arr[0].length);
}
}
// ----
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment.sol
+6
View File
@@ -2,6 +2,12 @@ pragma experimental SMTChecker;
contract C {
uint[] arr;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public view {
uint[] memory arr2 = arr;
arr2[2] = 3;
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_2.sol
+11 -2
View File
@@ -2,12 +2,21 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr[2].push();
arr[2].push();
arr[2].push();
arr[2].push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
uint z = arr.length;
arr[2][333] = 444;
arr[2][3] = 444;
assert(arr[2].length == x);
assert(arr[3].length == y);
assert(arr.length == z);
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_2_fail.sol
+16 -5
View File
@@ -2,18 +2,29 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr[2].push();
arr[2].push();
arr[2].push();
arr[2].push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
uint z = arr.length;
arr[2][333] = 444;
arr[2][3] = 444;
assert(arr[2].length != x);
assert(arr[3].length != y);
assert(arr.length != z);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (198-224): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (228-254): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (258-281): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (324-350): CHC: Assertion violation happens here.
// Warning 6328: (354-380): CHC: Assertion violation happens here.
// Warning 6328: (384-407): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_3.sol
+13 -1
View File
@@ -2,7 +2,19 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
test/libsolidity/smtCheckerTests/array_members/length_same_after_assignment_3_fail.sol
+15 -5
View File
@@ -2,7 +2,17 @@ pragma experimental SMTChecker;
contract C {
uint[][] arr;
uint[][] arr2;
constructor() {
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
arr.push();
}
function f() public {
uint x = arr[2].length;
uint y = arr[3].length;
@@ -16,7 +26,7 @@ contract C {
}
}
// ----
// Warning 6328: (222-248): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (252-278): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (282-305): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (309-335): CHC: Assertion violation happens here.\nCounterexample:\narr = [], arr2 = []\n\nTransaction trace:\nC.constructor()\nState: arr = [], arr2 = []\nC.f()
// Warning 6328: (352-378): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
// Warning 6328: (382-408): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
// Warning 6328: (412-435): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
// Warning 6328: (439-465): CHC: Assertion violation happens here.\nCounterexample:\narr = [[], [], [], [], [], [], [], [], []]\n\nTransaction trace:\nC.constructor()\nState: arr = [[], [], [], [], [], [], [], [], []]\nC.f()
test/libsolidity/smtCheckerTests/array_members/pop_2d_unsafe.sol
+2 -1
View File
@@ -3,10 +3,11 @@ pragma experimental SMTChecker;
contract C {
uint[][] a;
function f() public {
a.push();
a.push();
a[0].push();
a[1].pop();
}
}
// ----
// Warning 2529: (111-121): CHC: Empty array "pop" happens here.\nCounterexample:\na = [[0]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 2529: (123-133): CHC: Empty array "pop" happens here.\nCounterexample:\na = [[0], []]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
test/libsolidity/smtCheckerTests/array_members/push_as_lhs_2d_2.sol
+1 -1
View File
@@ -4,6 +4,6 @@ contract C {
function s() public returns (int[] memory) {
array2d.push() = array2d.push();
assert(array2d[array2d.length - 1].length == array2d[array2d.length - 2].length);
return array2d[2];
return array2d[1];
}
}
test/libsolidity/smtCheckerTests/array_members/push_as_lhs_and_rhs_2d_1.sol
+1 -1
View File
@@ -16,4 +16,4 @@ contract C {
}
}
// ----
// Warning 6328: (317-343): CHC: Assertion violation happens here.\nCounterexample:\nb = [[0], [0]]\n\nTransaction trace:\nC.constructor()\nState: b = []\nC.f()
// Warning 6328: (317-343): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/push_storage_ref_safe_aliasing.sol
+2
View File
@@ -14,5 +14,7 @@ contract C {
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6368: (212-216): CHC: Out of bounds access happens here.
// Warning 6368: (217-221): CHC: Out of bounds access happens here.
// Warning 3944: (217-232): CHC: Underflow (resulting value less than 0) happens here.
// Warning 6328: (205-239): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/push_storage_ref_unsafe_aliasing.sol
+4 -1
View File
@@ -8,8 +8,11 @@ contract C {
a[0][0] = 16;
uint[] storage b = a[0];
b[0] = 32;
// Access is safe but fails due to aliasing.
assert(a[0][0] == 16);
}
}
// ----
// Warning 6328: (167-188): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6368: (221-225): CHC: Out of bounds access happens here.\nCounterexample:\na = []\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6368: (221-228): CHC: Out of bounds access happens here.\nCounterexample:\na = [[], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15], [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6328: (214-235): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
test/libsolidity/smtCheckerTests/array_members/push_storage_ref_unsafe_length.sol
+19 -4
View File
@@ -4,20 +4,35 @@ contract C {
uint[][] a;
uint[][][] c;
uint[] d;
constructor() {
c.push().push().push();
d.push(); d.push();
}
function f() public {
a.push();
uint[] storage b = a[0];
// Access is safe but oob reported due to aliasing.
c[0][0][0] = 12;
d[5] = 7;
// Access is safe but oob reported due to aliasing.
d[1] = 7;
b.push(8);
assert(a[0].length == 0);
// Safe but knowledge about `c` is erased because `b` could be pointing to `c[x][y]`.
// Access is safe but oob reported due to aliasing.
assert(c[0][0][0] == 12);
// Safe but knowledge about `d` is erased because `b` could be pointing to `d`.
// Removed assertion because current Spacer seg faults in cex generation.
//assert(d[5] == 7);
//assert(d[1] == 7);
}
}
// ----
// Warning 6328: (193-217): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [], d = []\nC.f()
// Warning 6328: (309-333): CHC: Assertion violation happens here.
// Warning 6368: (271-275): CHC: Out of bounds access happens here.
// Warning 6368: (271-278): CHC: Out of bounds access might happen here.
// Warning 6368: (271-281): CHC: Out of bounds access might happen here.
// Warning 6368: (344-348): CHC: Out of bounds access happens here.
// Warning 6368: (376-380): CHC: Out of bounds access happens here.\nCounterexample:\na = [], d = [5, 5, 5, 5, 5, 5, 5, 5, 7, 5, 9, 5, 11, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5]\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6328: (369-393): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6368: (546-550): CHC: Out of bounds access happens here.\nCounterexample:\nc = []\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6368: (546-553): CHC: Out of bounds access happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nState: a = [], c = [[[0]]], d = [0, 0]\nC.f()
// Warning 6368: (546-556): CHC: Out of bounds access happens here.
// Warning 6328: (539-563): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/array_members/push_zero_2d_safe.sol
+1 -1
View File
@@ -4,7 +4,7 @@ contract C {
uint[][] a;
function f() public {
a.push();
a[0].push();
a[a.length - 1].push();
assert(a[a.length - 1][0] == 0);
}
}
test/libsolidity/smtCheckerTests/array_members/push_zero_2d_unsafe.sol
+2 -2
View File
@@ -4,9 +4,9 @@ contract C {
uint[][] a;
function f() public {
a.push();
a[0].push();
a[a.length - 1].push();
assert(a[a.length - 1][0] == 100);
}
}
// ----
// Warning 6328: (111-144): CHC: Assertion violation happens here.\nCounterexample:\na = [[0]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6328: (122-155): CHC: Assertion violation happens here.\nCounterexample:\na = [[0]]\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
test/libsolidity/smtCheckerTests/functions/getters/array_1.sol
+7 -2
View File
@@ -2,7 +2,12 @@ pragma experimental SMTChecker;
contract C {
uint[] public a;
constructor() {
a.push();
a.push();
a.push();
a.push();
}
function f() public view {
uint y = this.a(2);
assert(y == a[2]); // should hold
@@ -10,4 +15,4 @@ contract C {
}
}
// ----
// Warning 6328: (153-167): CHC: Assertion violation happens here.\nCounterexample:\na = []\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6328: (220-234): CHC: Assertion violation happens here.\nCounterexample:\na = [0, 0, 0, 0]\n\nTransaction trace:\nC.constructor()\nState: a = [0, 0, 0, 0]\nC.f()
test/libsolidity/smtCheckerTests/functions/getters/array_2.sol
+12 -2
View File
@@ -2,12 +2,22 @@ pragma experimental SMTChecker;
contract C {
uint[][] public a;
constructor() {
a.push();
a.push();
a.push();
a[2].push();
a[2].push();
a[2].push();
a[2].push();
}
function f() public view {
uint y = this.a(2,3);
assert(y == a[2][3]); // should hold
assert(y == 1); // should fail
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (160-174): CHC: Assertion violation happens here.\nCounterexample:\na = []\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f()
// Warning 6328: (275-289): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/functions/getters/nested_arrays_mappings_10.sol
+3 -1
View File
@@ -17,5 +17,7 @@ contract C {
assert(y == 1); // should fail
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (289-303): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.f()
// Warning 6328: (289-303): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/loops/for_loop_array_assignment_memory_memory.sol
+8 -2
View File
@@ -2,10 +2,13 @@ pragma experimental SMTChecker;
contract LoopFor2 {
function testUnboundedForLoop(uint n, uint[] memory b, uint[] memory c) public pure {
require(n < b.length);
require(n < c.length);
require(n > 0 && n < 100);
b[0] = 900;
uint[] memory a = b;
require(n > 0 && n < 100);
for (uint i = 0; i < n; i += 1) {
// Accesses are safe but oob is reported due to potential aliasing after c's assignment.
b[i] = i + 1;
c[i] = b[i];
}
@@ -20,4 +23,7 @@ contract LoopFor2 {
// ====
// SMTIgnoreCex: yes
// ----
// Warning 2072: (156-171): Unused local variable.
// Warning 2072: (235-250): Unused local variable.
// Warning 6368: (387-391): CHC: Out of bounds access happens here.
// Warning 6368: (411-415): CHC: Out of bounds access happens here.
// Warning 6368: (404-408): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/loops/for_loop_array_assignment_memory_storage.sol
+13 -2
View File
@@ -2,12 +2,18 @@ pragma experimental SMTChecker;
contract LoopFor2 {
uint[] a;
function p() public {
a.push();
}
function testUnboundedForLoop(uint n, uint[] memory b, uint[] memory c) public {
require(n < a.length);
require(n < b.length);
require(n < c.length);
require(n > 0 && n < 100);
b[0] = 900;
a = b;
require(n > 0 && n < 100);
for (uint i = 0; i < n; i += 1) {
// Accesses are safe but oob is reported due to potential aliasing after c's assignment.
b[i] = i + 1;
c[i] = b[i];
}
@@ -20,3 +26,8 @@ contract LoopFor2 {
// ====
// SMTSolvers: z3
// ----
// Warning 6368: (442-446): CHC: Out of bounds access happens here.
// Warning 1218: (466-470): CHC: Error trying to invoke SMT solver.
// Warning 6368: (466-470): CHC: Out of bounds access might happen here.
// Warning 1218: (459-463): CHC: Error trying to invoke SMT solver.
// Warning 6368: (459-463): CHC: Out of bounds access might happen here.
test/libsolidity/smtCheckerTests/loops/for_loop_array_assignment_storage_memory.sol
+4 -1
View File
@@ -4,8 +4,11 @@ pragma experimental SMTChecker;
contract LoopFor2 {
uint[] b;
//uint[] c;
function p() public {
b.push();
}
function testUnboundedForLoop(uint n) public {
require(b.length > 0);
b[0] = 900;
//uint[] memory a = b;
require(n > 0 && n < 100);
test/libsolidity/smtCheckerTests/loops/while_loop_array_assignment_memory_memory.sol
+8 -2
View File
@@ -2,11 +2,14 @@ pragma experimental SMTChecker;
contract LoopFor2 {
function testUnboundedForLoop(uint n, uint[] memory b, uint[] memory c) public pure {
require(n < b.length);
require(n < c.length);
require(n > 0 && n < 100);
b[0] = 900;
uint[] memory a = b;
require(n > 0 && n < 100);
uint i;
while (i < n) {
// Accesses are safe but oob is reported due to potential aliasing after c's assignment.
b[i] = i + 1;
c[i] = b[i];
++i;
@@ -23,4 +26,7 @@ contract LoopFor2 {
// SMTIgnoreCex: yes
// SMTSolvers: z3
// ----
// Warning 2072: (156-171): Unused local variable.
// Warning 2072: (235-250): Unused local variable.
// Warning 6368: (379-383): CHC: Out of bounds access happens here.
// Warning 6368: (403-407): CHC: Out of bounds access happens here.
// Warning 6368: (396-400): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/loops/while_loop_array_assignment_memory_storage.sol
+11 -1
View File
@@ -2,17 +2,26 @@ pragma experimental SMTChecker;
contract LoopFor2 {
uint[] a;
function p() public {
a.push();
}
function testUnboundedForLoop(uint n, uint[] memory b, uint[] memory c) public {
require(n < a.length);
require(n < b.length);
require(n < c.length);
b[0] = 900;
a = b;
require(n > 0 && n < 100);
uint i;
// Disabled because of Spacer nondeterminism.
/*
while (i < n) {
// Accesses are safe but oob is reported due to potential aliasing after c's assignment.
b[i] = i + 1;
c[i] = b[i];
++i;
}
*/
// Fails due to aliasing, since both b and c are
// memory references of same type.
// Removed because current Spacer seg faults in cex generation.
@@ -25,3 +34,4 @@ contract LoopFor2 {
// ====
// SMTSolvers: z3
// ----
// Warning 2072: (313-319): Unused local variable.
test/libsolidity/smtCheckerTests/loops/while_loop_array_assignment_storage_storage.sol
+13 -4
View File
@@ -3,11 +3,16 @@ pragma experimental SMTChecker;
contract LoopFor2 {
uint[] b;
uint[] c;
function p() public {
b.push();
c.push();
}
function testUnboundedForLoop(uint n) public {
require(n < b.length);
require(n < c.length);
require(n > 0 && n < 100);
b[0] = 900;
uint[] storage a = b;
require(n > 0 && n < 100);
uint i;
while (i < n) {
b[i] = i + 1;
@@ -20,5 +25,9 @@ contract LoopFor2 {
}
}
// ----
// Warning 6328: (338-357): CHC: Assertion violation happens here.\nCounterexample:\nb = [], c = []\nn = 1\n\nTransaction trace:\nLoopFor2.constructor()\nState: b = [], c = []\nLoopFor2.testUnboundedForLoop(1)
// Warning 6328: (361-380): CHC: Assertion violation happens here.\nCounterexample:\nb = [], c = []\nn = 1\n\nTransaction trace:\nLoopFor2.constructor()\nState: b = [], c = []\nLoopFor2.testUnboundedForLoop(1)
// Warning 6368: (321-325): CHC: Out of bounds access might happen here.
// Warning 6368: (345-349): CHC: Out of bounds access might happen here.
// Warning 6368: (338-342): CHC: Out of bounds access might happen here.
// Warning 6368: (444-448): CHC: Out of bounds access happens here.\nCounterexample:\nb = [1, 0], c = [1, 0]\nn = 1\n\nTransaction trace:\nLoopFor2.constructor()\nState: b = [], c = []\nLoopFor2.p()\nState: b = [0], c = [0]\nLoopFor2.p()\nState: b = [0, 0], c = [0, 0]\nLoopFor2.testUnboundedForLoop(1)
// Warning 6328: (437-456): CHC: Assertion violation happens here.\nCounterexample:\nb = [1, 0], c = [1, 0]\nn = 1\n\nTransaction trace:\nLoopFor2.constructor()\nState: b = [], c = []\nLoopFor2.p()\nState: b = [0], c = [0]\nLoopFor2.p()\nState: b = [0, 0], c = [0, 0]\nLoopFor2.testUnboundedForLoop(1)
// Warning 6328: (460-479): CHC: Assertion violation happens here.\nCounterexample:\nb = [1, 0], c = [1, 0]\nn = 1\n\nTransaction trace:\nLoopFor2.constructor()\nState: b = [], c = []\nLoopFor2.p()\nState: b = [0], c = [0]\nLoopFor2.p()\nState: b = [0, 0], c = [0, 0]\nLoopFor2.testUnboundedForLoop(1)
test/libsolidity/smtCheckerTests/operators/assignment_contract_member_variable_array_2.sol
+1
View File
@@ -2,6 +2,7 @@ pragma experimental SMTChecker;
contract A {
int[] a;
function f() public {
A.a.push();
A.a[0] = 2;
}
}
test/libsolidity/smtCheckerTests/operators/assignment_contract_member_variable_array_3.sol
+12 -2
View File
@@ -1,14 +1,22 @@
pragma experimental SMTChecker;
contract A {
int[] a;
constructor() {
p();
}
function p() public {
a.push(1);
}
function f() public {
require(a.length == 1 && a[0] == 1);
int[] storage u = a;
assert(u[0] == 1); // should hold
int[] memory b = new int[](2);
a = b;
// Access is safe but oob is reported due to aliasing.
assert(u[0] == 1); // should fail
A.a = b;
// Access is safe but oob is reported due to aliasing.
assert(u[0] == 1); // should fail
}
@@ -17,5 +25,7 @@ contract A {
}
}
// ----
// Warning 6328: (220-237): CHC: Assertion violation happens here.
// Warning 6328: (267-284): CHC: Assertion violation happens here.
// Warning 6368: (350-354): CHC: Out of bounds access happens here.\nCounterexample:\na = [0, 0]\n\nTransaction trace:\nA.constructor()\nState: a = [1]\nA.f()
// Warning 6328: (343-360): CHC: Assertion violation happens here.\nCounterexample:\na = [0, 0]\n\nTransaction trace:\nA.constructor()\nState: a = [1]\nA.f()
// Warning 6368: (454-458): CHC: Out of bounds access happens here.\nCounterexample:\na = [0, 0]\n\nTransaction trace:\nA.constructor()\nState: a = [1]\nA.f()
// Warning 6328: (447-464): CHC: Assertion violation happens here.\nCounterexample:\na = [0, 0]\n\nTransaction trace:\nA.constructor()\nState: a = [1]\nA.f()
test/libsolidity/smtCheckerTests/operators/bitwise_xor_fixed_bytes.sol
+3 -1
View File
@@ -7,5 +7,7 @@ contract Simp {
return y[0];
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (172-203): CHC: Assertion violation happens here.\nCounterexample:\n\n = 0\n\nTransaction trace:\nSimp.constructor()\nSimp.f3()
// Warning 6328: (172-203): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/operators/bytes_new.sol
+2
View File
@@ -34,3 +34,5 @@ contract C {
}
}
// ----
// Warning 6368: (501-505): CHC: Out of bounds access happens here.
// Warning 6368: (523-527): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/operators/compound_add_array_index.sol
+8 -1
View File
@@ -3,7 +3,14 @@ pragma experimental SMTChecker;
contract C
{
uint[] array;
constructor() {
q(); q();
}
function q() public {
array.push();
}
function f(uint x, uint p) public {
require(p < array.length);
require(x < 100);
array[p] = 100;
array[p] += array[p] + x;
@@ -12,4 +19,4 @@ contract C
}
}
// ----
// Warning 6328: (192-214): CHC: Assertion violation happens here.\nCounterexample:\narray = []\nx = 0\np = 38\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(0, 38)
// Warning 6328: (295-317): CHC: Assertion violation happens here.\nCounterexample:\narray = [0, 200]\nx = 0\np = 1\n\nTransaction trace:\nC.constructor()\nState: array = [0, 0]\nC.f(0, 1)
test/libsolidity/smtCheckerTests/operators/compound_assignment_division_2.sol
+8 -1
View File
@@ -1,7 +1,14 @@
pragma experimental SMTChecker;
contract C {
uint[] array;
constructor() {
q(); q();
}
function q() public {
array.push();
}
function f(uint x, uint p) public {
require(p < array.length);
require(x == 2);
array[p] = 10;
array[p] /= array[p] / x;
@@ -10,4 +17,4 @@ contract C {
}
}
// ----
// Warning 6328: (188-209): CHC: Assertion violation happens here.\nCounterexample:\narray = []\nx = 2\np = 0\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(2, 0)
// Warning 6328: (291-312): CHC: Assertion violation happens here.\nCounterexample:\narray = [2, 0]\nx = 2\np = 0\n\nTransaction trace:\nC.constructor()\nState: array = [0, 0]\nC.f(2, 0)
test/libsolidity/smtCheckerTests/operators/compound_bitwise_or_int_1.sol
+8
View File
@@ -9,4 +9,12 @@ contract C {
}
}
// ----
// Warning 6368: (108-113): CHC: Out of bounds access might happen here.
// Warning 6368: (108-116): CHC: Out of bounds access might happen here.
// Warning 6368: (151-156): CHC: Out of bounds access might happen here.
// Warning 6368: (151-159): CHC: Out of bounds access might happen here.
// Warning 6368: (181-186): CHC: Out of bounds access might happen here.
// Warning 6368: (181-189): CHC: Out of bounds access might happen here.
// Warning 6368: (198-203): CHC: Out of bounds access might happen here.
// Warning 6368: (198-206): CHC: Out of bounds access might happen here.
// Warning 6328: (174-212): CHC: Assertion violation might happen here.
test/libsolidity/smtCheckerTests/operators/compound_bitwise_or_uint_1.sol
+3
View File
@@ -9,4 +9,7 @@ contract C {
}
}
// ----
// Warning 6368: (108-112): CHC: Out of bounds access might happen here.
// Warning 6368: (147-151): CHC: Out of bounds access might happen here.
// Warning 6368: (173-177): CHC: Out of bounds access might happen here.
// Warning 6328: (166-183): CHC: Assertion violation might happen here.
test/libsolidity/smtCheckerTests/operators/compound_bitwise_or_uint_2.sol
+6
View File
@@ -4,6 +4,12 @@ contract C {
uint[] x;
}
S s;
constructor() {
s.x.push();
s.x.push();
s.x.push();
s.x.push();
}
function f(bool b) public {
if (b)
s.x[2] |= 1;
test/libsolidity/smtCheckerTests/operators/compound_mul_array_index.sol
+3 -1
View File
@@ -3,7 +3,9 @@ pragma experimental SMTChecker;
contract C
{
uint[] array;
function q() public { array.push(); }
function f(uint x, uint p) public {
require(p < array.length);
require(x < 10);
array[p] = 10;
array[p] *= array[p] + x;
@@ -12,4 +14,4 @@ contract C
}
}
// ----
// Warning 6328: (191-212): CHC: Assertion violation happens here.\nCounterexample:\narray = []\nx = 0\np = 38\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(0, 38)
// Warning 6328: (259-280): CHC: Assertion violation happens here.\nCounterexample:\narray = [100]\nx = 0\np = 0\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.q()\nState: array = [0]\nC.f(0, 0)
test/libsolidity/smtCheckerTests/operators/compound_sub_array_index.sol
+3 -1
View File
@@ -3,7 +3,9 @@ pragma experimental SMTChecker;
contract C
{
uint[] array;
function q() public { array.push(); }
function f(uint x, uint p) public {
require(p < array.length);
require(x < 100);
array[p] = 200;
array[p] -= array[p] - x;
@@ -14,4 +16,4 @@ contract C
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (191-212): CHC: Assertion violation happens here.
// Warning 6328: (259-280): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/operators/delete_array.sol
+5 -3
View File
@@ -4,15 +4,17 @@ contract C
{
uint[] a;
function f(bool b) public {
a.push();
a.push();
a.push();
a[2] = 3;
require(b);
if (b)
delete a;
else
delete a[2];
assert(a[2] == 0);
assert(a[1] == 0);
assert(a.length == 0);
}
}
// ----
// Warning 6838: (118-119): BMC: Condition is always true.
// Warning 6838: (154-155): BMC: Condition is always true.
test/libsolidity/smtCheckerTests/operators/delete_array_2d.sol
+7
View File
@@ -3,6 +3,13 @@ pragma experimental SMTChecker;
contract C
{
uint[][] a;
constructor() {
a.push(); a.push(); a.push();
a[2].push();
a[2].push();
a[2].push();
a[2].push();
}
function f() public {
require(a[2][3] == 4);
delete a;
test/libsolidity/smtCheckerTests/operators/delete_array_index.sol
+7 -1
View File
@@ -3,6 +3,12 @@ pragma experimental SMTChecker;
contract C
{
uint[] a;
constructor() {
a.push();
a.push();
a.push();
a.push();
}
function f(bool b) public {
a[2] = 3;
require(!b);
@@ -14,4 +20,4 @@ contract C
}
}
// ----
// Warning 6838: (119-120): BMC: Condition is always false.
// Warning 6838: (187-188): BMC: Condition is always false.
test/libsolidity/smtCheckerTests/operators/delete_array_index_2d.sol
+26 -2
View File
@@ -3,13 +3,26 @@ pragma experimental SMTChecker;
contract C
{
uint[][] a;
constructor() {
init();
}
function init() internal {
a.push();
a.push();
a.push();
a[1].push();
a[1].push();
a[2].push();
a[2].push();
}
function f(bool b) public {
a[1][1] = 512;
a[2][3] = 4;
a[2][1] = 4;
if (b)
delete a;
else
delete a[2];
init();
assert(a[2][3] == 0);
assert(a[1][1] == 0);
}
@@ -17,4 +30,15 @@ contract C
// ====
// SMTSolvers: z3
// ----
// Warning 6328: (191-211): CHC: Assertion violation happens here.\nCounterexample:\na = []\nb = false\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.f(false)
// Warning 6368: (247-251): CHC: Out of bounds access might happen here.
// Warning 6368: (247-254): CHC: Out of bounds access might happen here.
// Warning 6368: (264-268): CHC: Out of bounds access might happen here.
// Warning 6368: (264-271): CHC: Out of bounds access might happen here.
// Warning 6368: (316-320): CHC: Out of bounds access might happen here.
// Warning 6368: (341-345): CHC: Out of bounds access might happen here.
// Warning 6368: (341-348): CHC: Out of bounds access might happen here.
// Warning 6328: (334-354): CHC: Assertion violation might happen here.
// Warning 6368: (365-369): CHC: Out of bounds access might happen here.
// Warning 6368: (365-372): CHC: Out of bounds access might happen here.
// Warning 6328: (358-378): CHC: Assertion violation might happen here.
// Warning 4661: (358-378): BMC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/operators/delete_array_push.sol
+3 -4
View File
@@ -1,7 +1,7 @@
pragma experimental SMTChecker;
contract C {
int[][] array2d;
function s() public returns (int[] memory) {
function s() public {
delete array2d.push();
assert(array2d[array2d.length - 1].length == 0);
// Fails
@@ -12,9 +12,8 @@ contract C {
assert(array2d[length - 1][length2 - 1] == 0);
// Fails
assert(array2d[length - 1][length2 - 1] != 0);
return array2d[2];
}
}
// ----
// Warning 6328: (198-245): CHC: Assertion violation happens here.\nCounterexample:\narray2d = [[]]\n = []\n\nTransaction trace:\nC.constructor()\nState: array2d = []\nC.s()
// Warning 6328: (418-463): CHC: Assertion violation happens here.\nCounterexample:\narray2d = [[], [0]]\n = []\n\nTransaction trace:\nC.constructor()\nState: array2d = []\nC.s()
// Warning 6328: (175-222): CHC: Assertion violation happens here.\nCounterexample:\narray2d = [[]]\n\nTransaction trace:\nC.constructor()\nState: array2d = []\nC.s()
// Warning 6328: (395-440): CHC: Assertion violation happens here.\nCounterexample:\narray2d = [[], [0]]\n\nTransaction trace:\nC.constructor()\nState: array2d = []\nC.s()
test/libsolidity/smtCheckerTests/operators/delete_function.sol
+8 -1
View File
@@ -3,6 +3,12 @@ pragma experimental SMTChecker;
contract C
{
uint[] a;
constructor() { init(); }
function init() internal {
a.push();
a.push();
a.push();
}
function g() internal {
delete a;
}
@@ -16,9 +22,10 @@ contract C
g();
else
h();
init();
assert(a[2] == 0);
assert(a[1] == 0);
}
}
// ----
// Warning 6838: (201-202): BMC: Condition is always true.
// Warning 6838: (295-296): BMC: Condition is always true.
test/libsolidity/smtCheckerTests/operators/delete_multid_array.sol
+25 -9
View File
@@ -3,42 +3,58 @@ pragma experimental SMTChecker;
contract C {
uint[] a;
uint[][] b;
function f(uint x, uint y, uint v) public {
function p() public { a.push(); }
function q() public { b.push().push(); }
function f(uint x, uint v) public {
require(x < a.length);
a[x] = v;
delete a;
assert(a[y] == 0);
assert(a.length == 0);
}
function g(uint x, uint y, uint v) public {
require(x < b.length);
require(y < b[x].length);
b[x][y] = v;
delete b;
assert(b[y][x] == 0);
assert(b.length == 0);
}
function h(uint x, uint y, uint v) public {
require(x < b.length);
require(y < b[x].length);
b[x][y] = v;
delete b[x];
// Not necessarily the case.
// Removed because current Spacer seg faults in cex generation.
//assert(b[y][x] == 0);
assert(b[x].length == 0);
}
function i(uint x, uint y, uint v) public {
require(x < b.length);
require(y < b[x].length);
b[x][y] = v;
require(y < b.length);
delete b[y];
assert(b[y][x] == 0);
assert(b[y].length == 0);
}
function j(uint x, uint y, uint z, uint v) public {
require(x < b.length);
require(y < b[x].length);
b[x][y] = v;
require(z < b.length);
delete b[z];
// Not necessarily the case.
assert(b[y][x] == 0);
require(y < b.length);
require(x < b[x].length);
// Disabled because of Spacer nondeterminism.
//assert(b[y][x] == 0);
}
function setA(uint x, uint y) public {
require(x < a.length);
a[x] = y;
}
function setB(uint x, uint y, uint z) public {
require(x < b.length);
require(y < b[x].length);
b[x][y] = z;
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (685-705): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/operators/index_access_for_bytes.sol
+3 -4
View File
@@ -1,13 +1,12 @@
pragma experimental SMTChecker;
contract C {
function f(uint i) public pure {
function f() public pure {
bytes memory x = hex"00112233";
assert(x[0] == 0x00);
assert(x[1] == 0x11);
require(i > 3);
assert(x[i] == 0x00);
assert(x.length == 3);
}
}
// ----
// Warning 6328: (215-235): CHC: Assertion violation happens here.\nCounterexample:\n\ni = 4\n\nTransaction trace:\nC.constructor()\nC.f(4)
// Warning 6328: (185-206): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.f()
test/libsolidity/smtCheckerTests/operators/index_access_for_string.sol
+2 -4
View File
@@ -1,14 +1,12 @@
pragma experimental SMTChecker;
contract C {
function f(uint i) public pure {
function f() public pure {
string memory x = "\x12\x34";
bytes memory y = bytes(x);
assert(y[0] == 0x12);
assert(y[1] == 0x34);
require(i > 2);
assert(y[i] == 0x00);
assert(y.length == 2);
}
}
// ----
// Warning 6328: (248-268): CHC: Assertion violation happens here.\nCounterexample:\n\ni = 3\n\nTransaction trace:\nC.constructor()\nC.f(3)
test/libsolidity/smtCheckerTests/operators/index_access_side_effect.sol
+12 -1
View File
@@ -2,6 +2,13 @@ pragma experimental SMTChecker;
contract C {
uint[] a;
constructor() {
a.push();
a.push();
a.push();
a.push();
}
// Accesses are safe but oob is reported due to aliasing.
function h() internal returns (uint[] storage) {
if (a[2] == 0)
a[2] = 3;
@@ -15,4 +22,8 @@ contract C {
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (191-210): CHC: Assertion violation happens here.
// Warning 6368: (240-244): CHC: Out of bounds access happens here.
// Warning 6368: (254-258): CHC: Out of bounds access happens here.
// Warning 6368: (304-310): CHC: Out of bounds access happens here.
// Warning 6368: (325-331): CHC: Out of bounds access happens here.
// Warning 6328: (318-337): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/operators/integer_new.sol
+2
View File
@@ -34,3 +34,5 @@ contract C {
}
}
// ----
// Warning 6368: (507-511): CHC: Out of bounds access happens here.
// Warning 6368: (529-533): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/operators/slice.sol
+1
View File
@@ -2,6 +2,7 @@ pragma experimental SMTChecker;
contract C {
function f(bytes calldata b) external pure {
require(b.length > 10);
require(b[10] == 0xff);
assert(bytes(b[10:20]).length == 10);
// Disabled because of Spacer nondeterminism
test/libsolidity/smtCheckerTests/operators/slice_bytes.sol
+1
View File
@@ -1,6 +1,7 @@
pragma experimental SMTChecker;
contract C {
function f(bytes calldata b) external pure {
require(b.length > 10);
((b[:])[5]);
}
}
test/libsolidity/smtCheckerTests/operators/slice_default_start.sol
+4 -3
View File
@@ -2,6 +2,7 @@ pragma experimental SMTChecker;
contract C {
function f(bytes calldata b) external pure {
require(b.length > 20);
require(b[0] == 0xff);
assert(bytes(b[:20]).length == 20);
assert(bytes(b[:20])[0] == 0xff);
@@ -9,6 +10,6 @@ contract C {
}
}
// ----
// Warning 6328: (157-189): CHC: Assertion violation might happen here.
// Warning 6328: (193-225): CHC: Assertion violation happens here.
// Warning 4661: (157-189): BMC: Assertion violation happens here.
// Warning 6328: (183-215): CHC: Assertion violation might happen here.
// Warning 6328: (219-251): CHC: Assertion violation happens here.
// Warning 4661: (183-215): BMC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/operators/unary_add_array.sol
+5 -1
View File
@@ -3,7 +3,11 @@ pragma experimental SMTChecker;
contract C
{
uint[] array;
function p() public {
array.push();
}
function f(uint x) public {
require(x < array.length);
array[x] = 2;
uint a = ++array[x];
assert(array[x] == 3);
@@ -17,4 +21,4 @@ contract C
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (240-253): CHC: Assertion violation happens here.
// Warning 6328: (311-324): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/operators/unary_add_array_push_2.sol
+8
View File
@@ -5,6 +5,14 @@ contract C {
int[][] d;
}
S[] data;
constructor() {
data.push();
data.push();
data[1].d.push();
data[1].d.push();
data[1].d.push();
data[1].d.push();
}
function f() public {
++data[1].d[3].push();
}
test/libsolidity/smtCheckerTests/operators/unary_sub_array.sol
+3 -1
View File
@@ -3,7 +3,9 @@ pragma experimental SMTChecker;
contract C
{
uint[] array;
function p() public { array.push(); }
function f(uint x) public {
require(x < array.length);
array[x] = 5;
uint a = --array[x];
assert(array[x] == 4);
@@ -17,4 +19,4 @@ contract C
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (240-253): CHC: Assertion violation happens here.
// Warning 6328: (308-321): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/out_of_bounds/array_1.sol
+26
View File
@@ -0,0 +1,26 @@
pragma experimental SMTChecker;
contract C {
uint[] a;
uint l;
function p() public {
require(a.length < type(uint).max - 1);
a.push();
++l;
}
function q() public {
require(a.length > 0);
a.pop();
--l;
}
function r() public view returns (uint) {
require(l > 0);
return a[l]; // oob access
}
}
// ----
// Warning 4984: (145-148): CHC: Overflow (resulting value larger than 2**256 - 1) might happen here.
// Warning 3944: (214-217): CHC: Underflow (resulting value less than 0) might happen here.
// Warning 6368: (292-296): CHC: Out of bounds access happens here.\nCounterexample:\na = [0], l = 1\n = 0\n\nTransaction trace:\nC.constructor()\nState: a = [], l = 0\nC.p()\nState: a = [0], l = 1\nC.r()
// Warning 2661: (145-148): BMC: Overflow (resulting value larger than 2**256 - 1) happens here.
// Warning 4144: (214-217): BMC: Underflow (resulting value less than 0) happens here.
test/libsolidity/smtCheckerTests/out_of_bounds/array_2.sol
+23
View File
@@ -0,0 +1,23 @@
pragma experimental SMTChecker;
contract C {
uint[] a;
uint l;
function p() public {
require(a.length < type(uint).max - 1);
require(l < type(uint).max - 1);
a.push();
++l;
}
function q() public {
require(a.length > 0);
require(l > 0);
a.pop();
--l;
}
function r() public view returns (uint) {
require(l > 0);
return a[l - 1]; // safe access
}
}
// ----
test/libsolidity/smtCheckerTests/out_of_bounds/array_2d_1.sol
+15
View File
@@ -0,0 +1,15 @@
pragma experimental SMTChecker;
contract C {
uint[][] a;
function p() public { a.push(); }
function q(uint i) public {
require(i < a.length);
a[i].push();
}
function r(uint i, uint j) public view returns (uint) {
require(i < a.length);
require(j < a[i].length);
return a[i][j]; // safe access
}
}
test/libsolidity/smtCheckerTests/out_of_bounds/array_2d_2.sol
+16
View File
@@ -0,0 +1,16 @@
pragma experimental SMTChecker;
contract C {
uint[][] a;
function p() public { a.push(); }
function q(uint i) public {
require(i < a.length);
a[i].push();
}
function r(uint i, uint j) public view returns (uint) {
require(i < a.length);
return a[i][j]; // unsafe access
}
}
// ----
// Warning 6368: (257-264): CHC: Out of bounds access happens here.\nCounterexample:\na = [[]]\ni = 0\nj = 0\n = 0\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.p()\nState: a = [[]]\nC.r(0, 0)
test/libsolidity/smtCheckerTests/out_of_bounds/array_2d_3.sol
+15
View File
@@ -0,0 +1,15 @@
pragma experimental SMTChecker;
contract C {
uint[][] a;
function p() public { a.push(); }
function q(uint i) public {
require(i < a.length);
a[i].push();
}
function r() public view {
for (uint i = 0; i < a.length; ++i)
for (uint j = 0; j < a[i].length; ++j)
a[i][j]; // safe access
}
}
test/libsolidity/smtCheckerTests/out_of_bounds/array_2d_4.sol
+23
View File
@@ -0,0 +1,23 @@
pragma experimental SMTChecker;
contract C {
uint[][] a;
function p() public { a.push(); }
function q(uint i) public {
require(i < a.length);
a[i].push();
}
function r() public view {
for (uint i = 0; i < a.length + 10; ++i)
for (uint j = 0; j < a[i].length + 20; ++j)
a[i][j]; // oob access
}
}
// ----
// Warning 4984: (217-230): CHC: Overflow (resulting value larger than 2**256 - 1) might happen here.
// Warning 6368: (261-265): CHC: Out of bounds access happens here.\nCounterexample:\na = []\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.r()
// Warning 4984: (261-277): CHC: Overflow (resulting value larger than 2**256 - 1) might happen here.
// Warning 6368: (288-292): CHC: Out of bounds access happens here.\nCounterexample:\na = []\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.r()
// Warning 6368: (288-295): CHC: Out of bounds access happens here.\nCounterexample:\na = []\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.r()
// Warning 2661: (217-230): BMC: Overflow (resulting value larger than 2**256 - 1) happens here.
// Warning 2661: (261-277): BMC: Overflow (resulting value larger than 2**256 - 1) happens here.
test/libsolidity/smtCheckerTests/out_of_bounds/array_3.sol
+10
View File
@@ -0,0 +1,10 @@
pragma experimental SMTChecker;
contract C {
uint[] a;
function r(uint i) public view returns (uint) {
return a[i]; // oob access
}
}
// ----
// Warning 6368: (115-119): CHC: Out of bounds access happens here.\nCounterexample:\na = []\ni = 0\n = 0\n\nTransaction trace:\nC.constructor()\nState: a = []\nC.r(0)
test/libsolidity/smtCheckerTests/out_of_bounds/array_4.sol
+10
View File
@@ -0,0 +1,10 @@
pragma experimental SMTChecker;
contract C {
uint[] a;
function p() public { a.push(); }
function r(uint i) public view returns (uint) {
require(i < a.length);
return a[i]; // safe access
}
}
test/libsolidity/smtCheckerTests/out_of_bounds/fixed_bytes_1.sol
+7
View File
@@ -0,0 +1,7 @@
pragma experimental SMTChecker;
contract C {
function r(bytes4 x) public pure returns (bytes1) {
return x[0]; // safe access
}
}
test/libsolidity/smtCheckerTests/out_of_bounds/fixed_bytes_2.sol
+9
View File
@@ -0,0 +1,9 @@
pragma experimental SMTChecker;
contract C {
function r(bytes4 x, uint y) public pure returns (bytes1) {
return x[y]; // oob access
}
}
// ----
// Warning 6368: (116-120): CHC: Out of bounds access happens here.\nCounterexample:\n\nx = 0\ny = 4\n = 0\n\nTransaction trace:\nC.constructor()\nC.r(0, 4)
test/libsolidity/smtCheckerTests/out_of_bounds/fixed_bytes_3.sol
+9
View File
@@ -0,0 +1,9 @@
pragma experimental SMTChecker;
contract C {
function r(bytes32 x, uint y) public pure {
require(y <= 31);
x[0]; // safe access
x[y]; // safe access
}
}
test/libsolidity/smtCheckerTests/out_of_bounds/fixed_bytes_4.sol
+10
View File
@@ -0,0 +1,10 @@
pragma experimental SMTChecker;
contract C {
function r(bytes32 x, uint y) public pure {
x[0]; // safe access
x[y]; // oob access
}
}
// ----
// Warning 6368: (116-120): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/overflow/overflow_mul_cex_with_array.sol
+3 -1
View File
@@ -2,9 +2,11 @@ pragma experimental SMTChecker;
contract C {
function f(bytes calldata x, uint y) external pure {
require(x.length > 10);
x[8][0];
x[8][5*y];
}
}
// ----
// Warning 4984: (118-121): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.\nCounterexample:\n\ny = 23158417847463239084714197001737581570653996933128112807891516801582625927988\n\nTransaction trace:\nC.constructor()\nC.f(x, 23158417847463239084714197001737581570653996933128112807891516801582625927988)
// Warning 4984: (144-147): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.\nCounterexample:\n\nx = [38, 38, 38, 38, 38, 38, 9, 38, 38, 38, 13]\ny = 23158417847463239084714197001737581570653996933128112807891516801582625927988\n\nTransaction trace:\nC.constructor()\nC.f([38, 38, 38, 38, 38, 38, 9, 38, 38, 38, 13], 23158417847463239084714197001737581570653996933128112807891516801582625927988)
// Warning 6368: (139-148): CHC: Out of bounds access happens here.\nCounterexample:\n\nx = [38, 38, 38, 38, 38, 38, 38, 9, 38, 38, 38]\ny = 1\n\nTransaction trace:\nC.constructor()\nC.f([38, 38, 38, 38, 38, 38, 38, 9, 38, 38, 38], 1)
test/libsolidity/smtCheckerTests/special/msg_data.sol
+2 -2
View File
@@ -22,5 +22,5 @@ contract C
}
}
// ----
// Warning 6328: (153-180): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.f(){ value: 10450 }
// Warning 6328: (500-527): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.g(){ value: 10450 }
// Warning 6328: (153-180): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.f(){ value: 30612 }
// Warning 6328: (500-527): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.g(){ value: 30612 }
test/libsolidity/smtCheckerTests/try_catch/try_string_literal_to_fixed_bytes.sol
+3 -1
View File
@@ -13,5 +13,7 @@ contract C {
}
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (250-294): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.f()\n C.g() -- trusted external call
// Warning 6328: (250-294): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/types/array_aliasing_memory_1.sol
+24 -1
View File
@@ -10,7 +10,17 @@ contract C
uint8[][] memory dd,
uint[][][] memory eee
) public pure {
require(a.length > 0);
require(b.length > 0);
require(cc.length > 0);
require(cc[0].length > 0);
require(dd.length > 0);
require(dd[0].length > 0);
require(eee.length > 0);
require(eee[0].length > 0);
require(eee[0][0].length > 0);
a[0] = 2;
// The accesses below are safe but oob is reported because of aliasing.
cc[0][0] = 50;
dd[0][0] = 10;
eee[0][0][0] = 50;
@@ -26,4 +36,17 @@ contract C
}
}
// ----
// Warning 6328: (400-457): CHC: Assertion violation happens here.
// Warning 6368: (555-560): CHC: Out of bounds access happens here.
// Warning 6368: (555-563): CHC: Out of bounds access happens here.
// Warning 6368: (589-595): CHC: Out of bounds access happens here.
// Warning 6368: (589-598): CHC: Out of bounds access happens here.
// Warning 6368: (589-601): CHC: Out of bounds access happens here.
// Warning 6368: (610-614): CHC: Out of bounds access happens here.
// Warning 6368: (731-735): CHC: Out of bounds access happens here.
// Warning 6368: (744-749): CHC: Out of bounds access happens here.
// Warning 6368: (744-752): CHC: Out of bounds access happens here.
// Warning 6368: (762-768): CHC: Out of bounds access happens here.
// Warning 6368: (762-771): CHC: Out of bounds access happens here.
// Warning 6368: (762-774): CHC: Out of bounds access happens here.
// Warning 6328: (724-781): CHC: Assertion violation happens here.
// Warning 6368: (882-886): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/types/array_aliasing_memory_2.sol
+14 -1
View File
@@ -4,17 +4,30 @@ pragma abicoder v2;
contract C
{
uint[] array;
function p() public {
array.push();
}
function f(uint[] memory a, uint[] memory b) public {
require(a.length > 0);
require(b.length > 0);
require(array.length > 0);
array[0] = 42;
a[0] = 2;
// Access is safe but oob is reported due of aliasing.
b[0] = 1;
// Erasing knowledge about memory references should not
// erase knowledge about state variables.
// Removed because current Spacer seg faults.
//assert(array[0] == 42);
// Accesses are safe but oob is reported due of aliasing.
assert(a[0] == 2);
assert(b[0] == 1);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (371-388): CHC: Assertion violation happens here.
// Warning 6368: (359-363): CHC: Out of bounds access happens here.
// Warning 6368: (616-620): CHC: Out of bounds access happens here.
// Warning 6328: (609-626): CHC: Assertion violation happens here.
// Warning 6368: (637-641): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/types/array_aliasing_memory_3.sol
+5 -1
View File
@@ -4,10 +4,15 @@ pragma abicoder v2;
contract C
{
uint[] array;
constructor() {
array.push();
}
function f(uint[] memory a, uint[] memory b) public {
require(a.length > 0);
array[0] = 42;
uint[] storage c = array;
a[0] = 2;
require(b.length > 0);
b[0] = 1;
// Erasing knowledge about memory references should not
// erase knowledge about state variables.
@@ -21,4 +26,3 @@ contract C
//assert(b[0] == 1);
}
}
// ----
test/libsolidity/smtCheckerTests/types/array_aliasing_storage_1.sol
+9 -6
View File
@@ -40,12 +40,15 @@ contract C
}
function g(uint a, uint b, uint c, uint d, uint e) public {
f(array2d[a], array2d[b], array4d[c][c], tinyArray3d[d], array4d[e]);
require(a < array2d.length);
require(b < array2d.length);
require(c < array4d.length);
require(c < array4d[c].length);
require(d < tinyArray3d.length);
require(e < array4d.length);
// Disabled because of Spacer seg fault.
//f(array2d[a], array2d[b], array4d[c][c], tinyArray3d[d], array4d[e]);
}
}
// ----
// Warning 6328: (468-485): CHC: Assertion violation happens here.
// Warning 6328: (532-554): CHC: Assertion violation happens here.
// Warning 6328: (606-633): CHC: Assertion violation happens here.
// Warning 6328: (774-796): CHC: Assertion violation happens here.
// Warning 6328: (936-962): CHC: Assertion violation happens here.
// Warning 2018: (990-1362): Function state mutability can be restricted to view
test/libsolidity/smtCheckerTests/types/array_aliasing_storage_2.sol
+16 -1
View File
@@ -3,21 +3,36 @@ pragma experimental SMTChecker;
contract C
{
uint[][] array2d;
function p() public {
array2d.push().push();
}
function g(uint x, uint y, uint[] memory c) public {
require(x < array2d.length);
require(y < array2d.length);
f(array2d[x], array2d[y], c);
}
function f(uint[] storage a, uint[] storage b, uint[] memory c) internal {
require(a.length > 0);
require(b.length > 0);
require(c.length > 0);
c[0] = 42;
a[0] = 2;
// Access is safe but oob is reported because of aliasing.
b[0] = 1;
// Erasing knowledge about storage references should not
// erase knowledge about memory references.
assert(c[0] == 42);
// Fails because b == a is possible.
assert(a[0] == 2);
// Access is safe but oob is reported because of aliasing.
assert(b[0] == 1);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (436-453): CHC: Assertion violation happens here.\nCounterexample:\n\nx = 0\ny = 0\n\nTransaction trace:\nC.constructor()\nState: array2d = []\nC.g(0, 0, c)\n C.f([], [], c) -- internal call
// Warning 6368: (507-511): CHC: Out of bounds access happens here.
// Warning 6368: (692-696): CHC: Out of bounds access happens here.
// Warning 6328: (685-702): CHC: Assertion violation happens here.
// Warning 6368: (774-778): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/types/array_aliasing_storage_3.sol
+13 -2
View File
@@ -3,13 +3,20 @@ pragma experimental SMTChecker;
contract C
{
uint[][] array2d;
function p() public { array2d.push().push(); }
function g(uint x, uint y, uint[] memory c) public {
require(x < array2d.length);
require(y < array2d.length);
f(array2d[x], array2d[y], c);
}
function f(uint[] storage a, uint[] storage b, uint[] memory c) internal {
require(a.length > 0);
require(b.length > 0);
require(c.length > 0);
uint[] memory d = c;
c[0] = 42;
a[0] = 2;
// Access is safe but oob is reported due of aliasing.
b[0] = 1;
// Erasing knowledge about storage references should not
// erase knowledge about memory references.
@@ -20,6 +27,7 @@ contract C
// Disabled because of Spacer's seg fault.
//assert(d[0] == 42);
// Fails because b == a is possible.
// Accesses are safe but oob is reported due of aliasing.
assert(a[0] == 2);
assert(b[0] == 1);
}
@@ -27,5 +35,8 @@ contract C
// ====
// SMTIgnoreCex: yes
// ----
// Warning 2072: (232-247): Unused local variable.
// Warning 6328: (679-696): CHC: Assertion violation happens here.
// Warning 2072: (417-432): Unused local variable.
// Warning 6368: (522-526): CHC: Out of bounds access happens here.
// Warning 6368: (988-992): CHC: Out of bounds access happens here.
// Warning 6328: (981-998): CHC: Assertion violation happens here.
// Warning 6368: (1009-1013): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/types/array_aliasing_storage_4.sol
+12 -3
View File
@@ -4,8 +4,15 @@ contract C
{
uint[] array;
uint[][] array2d;
function p() public {
array.push();
array2d.push().push();
}
function f(uint[] storage a, uint[] storage b) internal {
require(a.length > 0);
require(b.length > 0);
a[0] = 2;
// Accesses are safe but oob is reported because of aliasing.
b[0] = 42;
array[0] = 1;
// Fails because array == a is possible.
@@ -15,11 +22,13 @@ contract C
assert(array[0] == 1);
}
function g(uint x, uint y) public {
f(array2d[x], array2d[y]);
require(x < array2d.length);
require(y < array2d.length);
// Disabled because of Spacer nondeterminism.
//f(array2d[x], array2d[y]);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (225-242): CHC: Assertion violation happens here.
// Warning 6328: (289-307): CHC: Assertion violation happens here.
// Warning 2018: (519-698): Function state mutability can be restricted to view
test/libsolidity/smtCheckerTests/types/array_aliasing_storage_5.sol
+13 -1
View File
@@ -5,10 +5,15 @@ contract C
uint[] b;
uint[] d;
uint[][] array2d;
function p() public {
array2d.push().push();
}
function g(uint x, uint[] memory c) public {
require(x < array2d.length);
f(array2d[x], c);
}
function f(uint[] storage a, uint[] memory c) internal {
// Accesses are safe but oob is reported because of aliasing.
d[0] = 42;
c[0] = 42;
a[0] = 2;
@@ -29,4 +34,11 @@ contract C
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (572-589): CHC: Assertion violation happens here.
// Warning 6368: (362-366): CHC: Out of bounds access happens here.
// Warning 6368: (375-379): CHC: Out of bounds access happens here.
// Warning 6368: (388-392): CHC: Out of bounds access happens here.
// Warning 6368: (400-404): CHC: Out of bounds access happens here.
// Warning 6368: (523-527): CHC: Out of bounds access happens here.
// Warning 6368: (725-729): CHC: Out of bounds access happens here.
// Warning 6328: (718-735): CHC: Assertion violation happens here.
// Warning 6368: (829-833): CHC: Out of bounds access happens here.
test/libsolidity/smtCheckerTests/types/array_branch_1d.sol
+3 -1
View File
@@ -10,5 +10,7 @@ contract C
assert(c[0] > 0);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (176-192): CHC: Assertion violation happens here.\nCounterexample:\n\nb = false\nc = [0, 8]\n\nTransaction trace:\nC.constructor()\nC.f(false, [38, 8])
// Warning 6328: (176-192): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/types/array_branch_2d.sol
+6 -1
View File
@@ -3,12 +3,17 @@ pragma experimental SMTChecker;
contract C
{
uint[][] c;
constructor() {
c.push().push();
}
function f(bool b) public {
// Disabled because of Spacer nondeterminism.
/*
c[0][0] = 0;
if (b)
c[0][0] = 1;
assert(c[0][0] > 0);
*/
}
}
// ----
// Warning 6328: (130-149): CHC: Assertion violation happens here.\nCounterexample:\nc = []\nb = false\n\nTransaction trace:\nC.constructor()\nState: c = []\nC.f(false)
test/libsolidity/smtCheckerTests/types/array_branch_3d.sol
+12 -1
View File
@@ -3,6 +3,11 @@ pragma experimental SMTChecker;
contract C
{
uint[][][] c;
constructor() {
c.push();
c[0].push();
c[0][0].push();
}
function f(bool b) public {
c[0][0][0] = 0;
if (b)
@@ -11,4 +16,10 @@ contract C
}
}
// ----
// Warning 6328: (138-160): CHC: Assertion violation happens here.\nCounterexample:\nc = []\nb = false\n\nTransaction trace:\nC.constructor()\nState: c = []\nC.f(false)
// Warning 6368: (157-164): CHC: Out of bounds access might happen here.
// Warning 6368: (157-167): CHC: Out of bounds access might happen here.
// Warning 6368: (185-192): CHC: Out of bounds access might happen here.
// Warning 6368: (185-195): CHC: Out of bounds access might happen here.
// Warning 6368: (210-217): CHC: Out of bounds access might happen here.
// Warning 6368: (210-220): CHC: Out of bounds access might happen here.
// Warning 6328: (203-225): CHC: Assertion violation happens here.\nCounterexample:\nc = [[[0]]]\nb = false\n\nTransaction trace:\nC.constructor()\nState: c = [[[0]]]\nC.f(false)
test/libsolidity/smtCheckerTests/types/array_branches_1d.sol
+2 -2
View File
@@ -2,7 +2,8 @@ pragma experimental SMTChecker;
contract C
{
function f(bool b, uint[] memory c) public {
function f(bool b, uint[] memory c) public pure {
require(c.length > 0);
c[0] = 0;
if (b)
c[0] = 1;
@@ -12,4 +13,3 @@ contract C
}
}
// ----
// Warning 2018: (47-168): Function state mutability can be restricted to pure
test/libsolidity/smtCheckerTests/types/array_branches_2d.sol
+5 -1
View File
@@ -3,7 +3,12 @@ pragma experimental SMTChecker;
contract C
{
uint[][] c;
function p() public {
c.push().push();
}
function f(bool b) public {
require(c.length > 0);
require(c[0].length > 0);
c[0][0] = 0;
if (b)
c[0][0] = 1;
@@ -12,4 +17,3 @@ contract C
assert(c[0][0] > 0);
}
}
// ----
test/libsolidity/smtCheckerTests/types/array_branches_3d.sol
+12 -3
View File
@@ -3,13 +3,22 @@ pragma experimental SMTChecker;
contract C
{
uint[][][] c;
constructor() {
c.push();
c[0].push();
c[0][0].push();
}
function f(bool b) public {
c[0][0][0] = 0;
if (b)
c[0][0][0] = 1;
else
c[0][0][0] = 2;
assert(c[0][0][0] > 0);
assert(c[0][0][0] < 2);
}
}
// ----
// Warning 6368: (157-164): CHC: Out of bounds access might happen here.
// Warning 6368: (157-167): CHC: Out of bounds access might happen here.
// Warning 6368: (185-192): CHC: Out of bounds access might happen here.
// Warning 6368: (185-195): CHC: Out of bounds access might happen here.
// Warning 6368: (210-217): CHC: Out of bounds access might happen here.
// Warning 6368: (210-220): CHC: Out of bounds access might happen here.
test/libsolidity/smtCheckerTests/types/array_dynamic_1.sol
+7
View File
@@ -3,7 +3,14 @@ pragma experimental SMTChecker;
contract C
{
uint[] array;
constructor() {
array.push();
array.push();
array.push();
array.push();
}
function f(uint x, uint y) public {
require(x < array.length);
array[x] = 200;
require(x == y);
assert(array[y] > 100);
test/libsolidity/smtCheckerTests/types/array_dynamic_1_fail.sol
+3 -1
View File
@@ -3,11 +3,13 @@ pragma experimental SMTChecker;
contract C
{
uint[] array;
function p() public { array.push(); }
function f(uint x, uint y) public {
require(x < array.length);
array[x] = 200;
require(x == y);
assert(array[y] > 300);
}
}
// ----
// Warning 6328: (137-159): CHC: Assertion violation happens here.\nCounterexample:\narray = []\nx = 38\ny = 38\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(38, 38)
// Warning 6328: (205-227): CHC: Assertion violation happens here.\nCounterexample:\narray = [200]\nx = 0\ny = 0\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.p()\nState: array = [0]\nC.f(0, 0)
test/libsolidity/smtCheckerTests/types/array_dynamic_2.sol
+3
View File
@@ -9,3 +9,6 @@ contract C
assert(array[z][t] > 100);
}
}
// ----
// Warning 6368: (131-139): CHC: Out of bounds access happens here.\nCounterexample:\narray = []\nx = 0\ny = 0\nz = 0\nt = 0\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(0, 0, 0, 0)
// Warning 6368: (131-142): CHC: Out of bounds access happens here.\nCounterexample:\narray = []\nx = 38\ny = 0\nz = 0\nt = 0\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(38, 0, 0, 0)
test/libsolidity/smtCheckerTests/types/array_dynamic_2_fail.sol
+8 -4
View File
@@ -3,12 +3,16 @@ pragma experimental SMTChecker;
contract C
{
uint[][] array;
function f(uint x, uint y, uint z, uint t) public view {
// TODO change to = 200 when 2d assignments are supported.
require(array[x][y] < 200);
function a() public {
array.push().push();
}
function f(uint x, uint y, uint z, uint t) public {
require(x < array.length);
require(y < array[x].length);
array[x][y] = 200;
require(x == z && y == t);
assert(array[z][t] > 300);
}
}
// ----
// Warning 6328: (243-268): CHC: Assertion violation happens here.\nCounterexample:\narray = []\nx = 38\ny = 7719\nz = 38\nt = 7719\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(38, 7719, 38, 7719)
// Warning 6328: (278-303): CHC: Assertion violation happens here.\nCounterexample:\narray = [[200]]\nx = 0\ny = 0\nz = 0\nt = 0\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.a()\nState: array = [[0]]\nC.f(0, 0, 0, 0)
test/libsolidity/smtCheckerTests/types/array_dynamic_3.sol
+3
View File
@@ -4,6 +4,9 @@ contract C
{
uint[][][] array;
function f(uint x, uint y, uint z, uint t, uint w, uint v) public view {
require(x < array.length);
require(y < array[x].length);
require(z < array[x][y].length);
require(array[x][y][z] == 200);
require(x == t && y == w && z == v);
assert(array[t][w][v] > 100);
test/libsolidity/smtCheckerTests/types/array_dynamic_3_fail.sol
+9 -4
View File
@@ -3,12 +3,17 @@ pragma experimental SMTChecker;
contract C
{
uint[][][] array;
function f(uint x, uint y, uint z, uint t, uint w, uint v) public view {
// TODO change to = 200 when 3d assignments are supported.
require(array[x][y][z] < 200);
function p() public {
array.push().push().push();
}
function f(uint x, uint y, uint z, uint t, uint w, uint v) public {
require(x < array.length);
require(y < array[x].length);
require(z < array[x][y].length);
array[x][y][z] = 200;
require(x == t && y == w && z == v);
assert(array[t][w][v] > 300);
}
}
// ----
// Warning 6328: (274-302): CHC: Assertion violation happens here.\nCounterexample:\narray = []\nx = 21238\ny = 38\nz = 7719\nt = 21238\nw = 38\nv = 7719\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.f(21238, 38, 7719, 21238, 38, 7719)
// Warning 6328: (351-379): CHC: Assertion violation happens here.\nCounterexample:\narray = [[[200]]]\nx = 0\ny = 0\nz = 0\nt = 0\nw = 0\nv = 0\n\nTransaction trace:\nC.constructor()\nState: array = []\nC.p()\nState: array = [[[0]]]\nC.f(0, 0, 0, 0, 0, 0)
test/libsolidity/smtCheckerTests/types/array_dynamic_parameter_1.sol
+1
View File
@@ -3,6 +3,7 @@ pragma experimental SMTChecker;
contract C
{
function f(uint[] memory array, uint x, uint y) public pure {
require(x < array.length);
array[x] = 200;
require(x == y);
assert(array[y] > 100);
test/libsolidity/smtCheckerTests/types/array_dynamic_parameter_1_fail.sol
+2 -1
View File
@@ -3,10 +3,11 @@ pragma experimental SMTChecker;
contract C
{
function f(uint[] memory array, uint x, uint y) public pure {
require(x < array.length);
array[x] = 200;
require(x == y);
assert(array[y] > 300);
}
}
// ----
// Warning 6328: (148-170): CHC: Assertion violation happens here.\nCounterexample:\n\nx = 38\ny = 38\n\nTransaction trace:\nC.constructor()\nC.f(array, 38, 38)
// Warning 6328: (177-199): CHC: Assertion violation happens here.\nCounterexample:\n\nx = 7719\ny = 7719\n\nTransaction trace:\nC.constructor()\nC.f(array, 7719, 7719)
test/libsolidity/smtCheckerTests/types/array_mapping_aliasing_1.sol
+15 -1
View File
@@ -6,12 +6,22 @@ contract C
mapping (uint => uint)[] severalMaps;
mapping (uint => uint8)[] severalMaps8;
mapping (uint => uint)[][] severalMaps3d;
function p() public {
severalMaps.push();
severalMaps8.push();
severalMaps3d.push().push();
}
function f(mapping (uint => uint) storage map) internal {
require(severalMaps.length > 0);
require(severalMaps8.length > 0);
require(severalMaps3d.length > 0);
require(severalMaps3d[0].length > 0);
severalMaps[0][0] = 42;
severalMaps8[0][0] = 42;
severalMaps3d[0][0][0] = 42;
map[0] = 2;
// Should fail since map == severalMaps[0] is possible.
// Access is safe but oob is reported because of aliasing.
assert(severalMaps[0][0] == 42);
// Should not fail since knowledge is erased only for mapping (uint => uint).
assert(severalMaps8[0][0] == 42);
@@ -20,8 +30,12 @@ contract C
//assert(severalMaps3d[0][0][0] == 42);
}
function g(uint x) public {
require(x < severalMaps.length);
f(severalMaps[x]);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (421-452): CHC: Assertion violation happens here.\nCounterexample:\n\nx = 38\n\nTransaction trace:\nC.constructor()\nC.g(38)\n C.f(map) -- internal call
// Warning 6368: (739-753): CHC: Out of bounds access happens here.
// Warning 6328: (732-763): CHC: Assertion violation happens here.
test/libsolidity/smtCheckerTests/types/array_mapping_aliasing_2.sol
+16 -1
View File
@@ -6,8 +6,15 @@ contract C
mapping (uint => uint)[] severalMaps;
mapping (uint => uint8)[] severalMaps8;
mapping (uint => uint)[][] severalMaps3d;
constructor() {
severalMaps.push();
severalMaps8.push();
severalMaps3d.push().push();
}
function f(mapping (uint => uint) storage map) internal {
map[0] = 42;
// Index accesses are safe but the assignment above makes
// them fail because of aliasing.
severalMaps[0][0] = 42;
severalMaps8[0][0] = 42;
severalMaps3d[0][0][0] = 42;
@@ -22,10 +29,18 @@ contract C
assert(map[0] == 42);
}
function g(uint x) public {
require(x < severalMaps.length);
f(severalMaps[x]);
}
}
// ====
// SMTIgnoreCex: yes
// ----
// Warning 6328: (777-797): CHC: Assertion violation happens here.
// Warning 6368: (472-486): CHC: Out of bounds access happens here.
// Warning 6368: (525-541): CHC: Out of bounds access happens here.
// Warning 6368: (525-544): CHC: Out of bounds access happens here.
// Warning 6368: (655-669): CHC: Out of bounds access happens here.
// Warning 6368: (883-899): CHC: Out of bounds access happens here.
// Warning 6368: (883-902): CHC: Out of bounds access happens here.
// Warning 6328: (969-989): CHC: Assertion violation happens here.
// Warning 6368: (1062-1076): CHC: Out of bounds access might happen here.
test/libsolidity/smtCheckerTests/types/array_static_1.sol
+1
View File
@@ -4,6 +4,7 @@ contract C
{
uint[10] array;
function f(uint x, uint y) public {
require(x < array.length);
array[x] = 200;
require(x == y);
assert(array[y] > 100);
test/libsolidity/smtCheckerTests/types/array_static_1_fail.sol
+2 -1
View File
@@ -4,10 +4,11 @@ contract C
{
uint[10] array;
function f(uint x, uint y) public {
require(x < array.length);
array[x] = 200;
require(x == y);
assert(array[y] > 300);
}
}
// ----
// Warning 6328: (139-161): CHC: Assertion violation happens here.\nCounterexample:\narray = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\nx = 38\ny = 38\n\nTransaction trace:\nC.constructor()\nState: array = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\nC.f(38, 38)
// Warning 6328: (168-190): CHC: Assertion violation happens here.\nCounterexample:\narray = [0, 0, 0, 0, 0, 0, 0, 0, 0, 200]\nx = 9\ny = 9\n\nTransaction trace:\nC.constructor()\nState: array = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\nC.f(9, 9)
test/libsolidity/smtCheckerTests/types/array_static_2.sol
+2
View File
@@ -4,6 +4,8 @@ contract C
{
uint[10][20] array;
function f(uint x, uint y, uint z, uint t) public view {
require(x < array.length);
require(y < array[x].length);
require(array[x][y] == 200);
require(x == z && y == t);
assert(array[z][t] > 100);
test/libsolidity/smtCheckerTests/types/array_static_2_fail.sol
+3 -1
View File
@@ -4,10 +4,12 @@ contract C
{
uint[10][20] array;
function f(uint x, uint y, uint z, uint t) public view {
require(x < array.length);
require(y < array[x].length);
require(array[x][y] < 200);
require(x == z && y == t);
assert(array[z][t] > 300);
}
}
// ----
// Warning 6328: (186-211): CHC: Assertion violation happens here.\nCounterexample:\narray = [[0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]]\nx = 38\ny = 7719\nz = 38\nt = 7719\n\nTransaction trace:\nC.constructor()\nState: array = [[0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]]\nC.f(38, 7719, 38, 7719)
// Warning 6328: (247-272): CHC: Assertion violation happens here.\nCounterexample:\narray = [[0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]]\nx = 19\ny = 8\nz = 19\nt = 8\n\nTransaction trace:\nC.constructor()\nState: array = [[0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]]\nC.f(19, 8, 19, 8)

Some files were not shown because too many files have changed in this diff Show More