blob: f07b971023fa3d57e5af7c0a7417acee806e6f3d (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
// RUN: echo "x" > %t1.res
// RUN: echo "x" >> %t1.res
// RUN: echo "x" >> %t1.res
// RUN: echo "x" >> %t1.res
// RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc
// RUN: %klee %t1.bc > %t1.log
// RUN: diff %t1.res %t1.log
#include <stdio.h>
unsigned klee_urange(unsigned start, unsigned end) {
unsigned x;
klee_make_symbolic(&x, sizeof x);
if (x-start>=end-start) klee_silent_exit(0);
return x;
}
int *make_int(int i) {
int *x = malloc(sizeof(*x));
*x = i;
return x;
}
int main() {
int *buf[4];
int i,s,t;
for (i=0; i<4; i++)
buf[i] = make_int((i+1)*2);
s = klee_urange(0,4);
*buf[s] = 5;
if ((*buf[0] + *buf[1] + *buf[2] + *buf[3]) == 17)
if (s!=3)
abort();
printf("x\n");
fflush(stdout);
return 0;
}
|