Executor: do not crash on non-sized globals

Sometimes, globals are not sized and ->getTypeStoreSize on such type
crashes inside the LLVM. Check whether type is sized prior to calling
the function above.

A minimalistic example of Y being unsized with no effect on the actual
code is put to tests.

[v2]
Use klee_warning for printing. And use %.*s formatting string given
StringRef.data() need not be null terminated.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

2 files changed, 21 insertions, 4 deletions

diff --git a/lib/Core/Executor.cpp b/lib/Core/Executor.cpp
index 2f5bdb0c..acd02c67 100644
--- a/lib/Core/Executor.cpp
+++ b/lib/Core/Executor.cpp
@@ -562,7 +562,13 @@ void Executor::initializeGlobals(ExecutionState &state) {
       // hack where we check the object file information.
 
       LLVM_TYPE_Q Type *ty = i->getType()->getElementType();
-      uint64_t size = kmodule->targetData->getTypeStoreSize(ty);
+      uint64_t size = 0;
+      if (ty->isSized()) {
+	size = kmodule->targetData->getTypeStoreSize(ty);
+      } else {
+        klee_warning("Type for %.*s is not sized", (int)i->getName().size(),
+			i->getName().data());
+      }
 
       // XXX - DWD - hardcode some things until we decide how to fix.
 #ifndef WINDOWS
@@ -576,9 +582,8 @@ void Executor::initializeGlobals(ExecutionState &state) {
 #endif
 
       if (size == 0) {
-        llvm::errs() << "Unable to find size for global variable: " 
-                     << i->getName() 
-                     << " (use will result in out of bounds access)\n";
+        klee_warning("Unable to find size for global variable: %.*s (use will result in out of bounds access)",
+			(int)i->getName().size(), i->getName().data());
       }
 
       MemoryObject *mo = memory->allocate(size, false, true, i);
diff --git a/test/Feature/NonSizedGlobals.c b/test/Feature/NonSizedGlobals.c
new file mode 100644
index 00000000..b98f7bf1
--- /dev/null
+++ b/test/Feature/NonSizedGlobals.c
@@ -0,0 +1,12 @@
+// RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc
+// RUN: rm -rf %t.klee-out
+// RUN: %klee --output-dir=%t.klee-out --exit-on-error %t1.bc
+
+struct X;
+extern struct X Y;
+void *ptr = &Y;
+
+int main()
+{
+	return 0;
+}