about summary refs log tree commit diff homepage
path: root/lib
diff options
context:
space:
mode:
authorFrank Busse <bb0xfb@gmail.com>2019-08-02 16:54:57 +0100
committerMartinNowack <martin.nowack@gmail.com>2019-10-31 15:38:21 +0000
commit2b0b0f89fcfff828b6dd8c20f58d872c7395dba4 (patch)
tree5576a5fd49f8b764334cc0490e82ea2dce68fa37 /lib
parent24996597043fd8fb76a6b0fa781fcb0197050dab (diff)
downloadklee-2b0b0f89fcfff828b6dd8c20f58d872c7395dba4.tar.gz
Executor: fix missing default case in switch instruction
Diffstat (limited to 'lib')
-rw-r--r--lib/Core/Executor.cpp9
1 files changed, 6 insertions, 3 deletions
diff --git a/lib/Core/Executor.cpp b/lib/Core/Executor.cpp
index 655d6005..4ff181f5 100644
--- a/lib/Core/Executor.cpp
+++ b/lib/Core/Executor.cpp
@@ -1795,10 +1795,9 @@ void Executor::executeInstruction(ExecutionState &state, KInstruction *ki) {
       // Handle possible different branch targets
 
       // We have the following assumptions:
-      // - each case value is mutual exclusive to all other values including the
-      //   default value
+      // - each case value is mutual exclusive to all other values
       // - order of case branches is based on the order of the expressions of
-      //   the scase values, still default is handled last
+      //   the case values, still default is handled last
       std::vector<BasicBlock *> bbOrder;
       std::map<BasicBlock *, ref<Expr> > branchTargets;
 
@@ -1822,6 +1821,10 @@ void Executor::executeInstruction(ExecutionState &state, KInstruction *ki) {
            it != itE; ++it) {
         ref<Expr> match = EqExpr::create(cond, it->first);
 
+        // skip if case has same successor basic block as default case
+        // (should work even with phi nodes as a switch is a single terminating instruction)
+        if (it->second == si->getDefaultDest()) continue;
+
         // Make sure that the default value does not contain this target's value
         defaultValue = AndExpr::create(defaultValue, Expr::createIsZero(match));