/* This test needs deterministic allocation with enough spacing between the allocations. Otherwise, if by coincidence the allocated vararg memory object is directly before another valid memory object, KLEE will be able to resolve the out-of-bounds access with another object and not detect the false access. This will fail this test case. */ // RUN: %clang %s -emit-llvm %O0opt -c -g -o %t1.bc // RUN: rm -rf %t.klee-out // RUN: %klee --output-dir=%t.klee-out --kdalloc %t1.bc | FileCheck %s // RUN: test -f %t.klee-out/test000001.ptr.err #include #include #include struct triple { int first, second, third; }; void test1(int x, ...) { va_list ap; va_start(ap, x); int i32 = va_arg(ap, int); long long i64 = va_arg(ap, long long); double d = va_arg(ap, double); struct triple p = va_arg(ap, struct triple); printf("types: (%d, %lld, %.2f, (%d,%d,%d))\n", i32, i64, d, p.first, p.second, p.third); va_end(ap); } int sum(int N, ...) { int i, res = 0; va_list ap,ap2; va_start(ap, N); for (i=0; i