Inequalities between pointers do not work #1680
Description
Looking further through SV-COMP tasks, I stumbled upon an imprecision due to inequalities between pointers.
In task loops/veris.c_NetBSD-libc_loop.i:
...
typedef int Char;
Char *tmp;
int glob2 (Char *pathbuf, Char *pathlim) {
Char *p;
for (p = pathbuf; p <= pathlim; p++) {
__VERIFIER_assert(p<=tmp);
*p = 1;
}
return 0;
}
int main () {
Char pathbuf[1 +1];
Char *bound = pathbuf + sizeof(pathbuf)/sizeof(*pathbuf) - 1;
tmp = pathbuf + sizeof(pathbuf)/sizeof(*pathbuf) - 1;
glob2 (pathbuf, bound);
return 0;
}In function glob2, the loop bound pathlim is pathbuf[1], but p runs past it; and with unrolling, the loop body where p → pathbuf[2] is not dead.
The length of pathbuf is 2, and the loop should stop at index 1. However, since this is unknown due to the pointer inequality not working, we fail to verify memsafety.
The following minimization can be used as a regression test when solving this issue:
typedef int Char;
int main () {
Char pathbuf[1 +1];
Char *ptr = pathbuf;
Char *bound = pathbuf + 1;
__goblint_check(ptr < bound); // SUCCESS
return 0;
}