about summary refs log tree commit diff homepage
diff options
context:
space:
mode:
authorMartin Nowack <m.nowack@imperial.ac.uk>2020-04-26 17:27:24 +0100
committerCristian Cadar <c.cadar@imperial.ac.uk>2020-05-01 12:14:08 +0100
commitfef5893503cd35786a15485406bb08cd1c031b9e (patch)
tree4f96cbd2c24256d03e1c47d76e8a17c80229b0cb
parent09373ca1ce792c6463b0fc105dd4934937361fd2 (diff)
downloadklee-fef5893503cd35786a15485406bb08cd1c031b9e.tar.gz
[Solver:STP] Fix handling of array names
Array names used for STP queries used to be restricted to 32 characters,
with the last characters replaced by a unique number.

Similarly, an array is made unique by `klee_make_symbolic`.

Unfortunately, both combined can lead to the generation of the same STP array name for different arrays.
This leads to wrong queries with invalid results.

This is more likely be triggered with longer names for `klee_make_symbolic`

Fixes #1257
-rw-r--r--lib/Solver/STPBuilder.cpp8
-rw-r--r--lib/Solver/Z3Builder.cpp8
2 files changed, 4 insertions, 12 deletions
diff --git a/lib/Solver/STPBuilder.cpp b/lib/Solver/STPBuilder.cpp
index 9fd9dc8e..13a42513 100644
--- a/lib/Solver/STPBuilder.cpp
+++ b/lib/Solver/STPBuilder.cpp
@@ -436,12 +436,8 @@ ExprHandle STPBuilder::constructSDivByConstant(ExprHandle expr_n, unsigned width
   if (!hashed) {
     // STP uniques arrays by name, so we make sure the name is unique by
     // using the size of the array hash as a counter.
-    std::string unique_id = llvm::itostr(_arr_hash._array_hash.size());
-    unsigned const uid_length = unique_id.length();
-    unsigned const space = (root->name.length() > 32 - uid_length)
-                               ? (32 - uid_length)
-                               : root->name.length();
-    std::string unique_name = root->name.substr(0, space) + unique_id;
+    std::string unique_id = llvm::utostr(_arr_hash._array_hash.size());
+    std::string unique_name = root->name + unique_id;
 
     array_expr = buildArray(unique_name.c_str(), root->getDomain(),
                             root->getRange());
diff --git a/lib/Solver/Z3Builder.cpp b/lib/Solver/Z3Builder.cpp
index ce584175..950bd879 100644
--- a/lib/Solver/Z3Builder.cpp
+++ b/lib/Solver/Z3Builder.cpp
@@ -392,12 +392,8 @@ Z3ASTHandle Z3Builder::getInitialArray(const Array *root) {
   if (!hashed) {
     // Unique arrays by name, so we make sure the name is unique by
     // using the size of the array hash as a counter.
-    std::string unique_id = llvm::itostr(_arr_hash._array_hash.size());
-    unsigned const uid_length = unique_id.length();
-    unsigned const space = (root->name.length() > 32 - uid_length)
-                               ? (32 - uid_length)
-                               : root->name.length();
-    std::string unique_name = root->name.substr(0, space) + unique_id;
+    std::string unique_id = llvm::utostr(_arr_hash._array_hash.size());
+    std::string unique_name = root->name + unique_id;
 
     array_expr = buildArray(unique_name.c_str(), root->getDomain(),
                             root->getRange());