goblint / goblint/analyzer

`uninit` analysis misses uninitialized variables accessed through the pointers after integer round-trip

Open
#2,136 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
OCaml
Stars
252
Forks
90
Avg merge
4d 1m
Merged PRs (30d)
19

Description

Tested with nightly Goblint image (sha256:691055f2e25b2b101041a8d348c3fedc9da6143d5831e8aa2bad81d16f35aa86), the following test case

// PARAM: --set ana.activated[+] uninit

#include <stdint.h>

int main(void) {
  int value;
  uintptr_t address = (uintptr_t)(void *)&value;
  int *pointer = (void *)address;
  return *pointer; // TODO WARN: uninitialized value
}

does not produce a warning on *pointer despite the fact that pointer is &value after round-trip through uintptr_t. Instead, Goblint reports [Info][Unsound] Access to unknown address could be global. However, with conf/examples/very-precise.json no warnings are reported at all, which is unsound.

The issue was discovered by a coding agent when testing the effects implementation

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the provided C test case with the uninit analysis enabled, then compare its behavior with conf/examples/very-precise.json. Trace the effects implementation and the handling of pointers converted through uintptr_t; done means the dereference produces the expected uninitialized-value warning without the unsound unknown-address result.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, ocaml
Domain
compilers, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.