Open
Description
The bounds widening for pointers to null-terminated arrays relies on flow-sensitive bounds declarations for widening bounds using strlen
. Currently the bounds widening is unsound because the flow-sensitive bounds declarations are not checked or used. We should implement flow-sensitive bounds checking. The implementation can be done in 4 stages:
- Compute the extent of bounds declarations: Compute the extent of flow-sensitive bounds declarations #1208
- Check bounds declarations in
_Where
clauses: Check bounds declarations in where clauses #1209 - Use the flow-sensitive bounds declarations for bounds-checking memory accesses: Use flow-sensitive bounds declarations for bounds-checking memory accesses #1210.
- Check flow-sensitive bounds declarations in their extents. We also have to make sure that statements within the extent of bounds declaration maintain the flow-sensitive bounds declarations: Check flow-sensitive bounds declarations within their extents #1211
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Status
In Progress