[Question] How to make infer analyze go deeper into the code?

[ChengsongTan]

It seems that infer has imposed a limit on how deep they analyze loops/number of steps of code. When I have code with multiple loops each going for many iterations, only the first couple of errors that should be spotted are actually found.

Here's a MWE, if we have the long loop at the beginning with 50 iterations commented, like this:

#include <stdio.h>
#include <stdlib.h>

#define BADFUNC(i) do{int *p = malloc(sizeof(int) * (i + 1)); *p = 1;} while(0)

int main() {
    // for (int i = 0; i < 50; i++) {
    //     BADFUNC(i);
    // }
    
    for (int j = 0; j < 1; j++) {
        BADFUNC(j + 50);
    }
    
    for (int k = 0; k < 1; k++) {
        BADFUNC(k + 80);
    }
    
    for (int m = 0; m < 1; m++) {
        BADFUNC(m + 150);
    }
    
    for (int n = 0; n < 1; n++) {
        BADFUNC(n + 190);
    }
    
    printf("Test finished\n");
    return 0;
}

Then all the BADFUNC sites are identified as having memory safety issues.

Uncommenting the first loop with 50 iterations leads to the rest of BADFUNC errors going unnoticed by Infer.

How can we increase this limit, is there an option for specifying this? Or perhaps I'm using Infer in an incorrect way?

Best,
Chengsong