MCPcopy Index your code
hub / github.com/Rust-API/Rust-API-Bypass-Checker / check_assert_condition

Method check_assert_condition

src/checker/assertion_checker.rs:141–182  ·  view source on GitHub ↗
(
        &self,
        cond: Rc<SymbolicValue>,
        expect: bool,
        abstract_value: &AbstractDomain<DomainType>,
    )

Source from the content-addressed store, hash-verified

139 }
140
141 pub fn check_assert_condition(
142 &self,
143 cond: Rc<SymbolicValue>,
144 expect: bool,
145 abstract_value: &AbstractDomain<DomainType>,
146 ) -> CheckerResult {
147 let solver = &self.body_visitor.z3_solver;
148
149 Self::add_numerical_constraints(&solver, abstract_value);
150
151 let result;
152 debug!("In converting assertion condition: {:?}", cond);
153 let z3_cond_expr = if expect == false {
154 solver.make_not_z3_expression(
155 solver.convert_to_bool_sort(solver.get_symbolic_as_z3_expression(&cond)),
156 )
157 } else {
158 solver.convert_to_bool_sort(solver.get_symbolic_as_z3_expression(&cond))
159 };
160 match solver.solve_expression(&z3_cond_expr) {
161 SmtResult::Unsat => {
162 // assert is always false
163 result = CheckerResult::Unsafe;
164 }
165 SmtResult::Sat => {
166 // assert is satisfiable, now check whether `not cond_val` is always false
167 let cst = solver.make_not_z3_expression(z3_cond_expr);
168 if solver.solve_expression(&cst) == SmtResult::Unsat {
169 // `not cond_val` is always false, so `cond_val` is always true
170 result = CheckerResult::Safe;
171 } else {
172 result = CheckerResult::Warning;
173 }
174 }
175 SmtResult::Unknown => {
176 result = CheckerResult::Warning;
177 }
178 }
179 solver.reset();
180
181 result
182 }
183
184 // Add constraints from the numerical abstract domain
185 fn add_numerical_constraints(solver: &Z3Solver, abstract_value: &AbstractDomain<DomainType>) {

Callers 9

run_terminatorMethod · 0.80
check_overflowMethod · 0.80
handle_get_checkedMethod · 0.80
handle_checked_addMethod · 0.80
handle_swapMethod · 0.80
handle_get_uncheckedMethod · 0.80
handle_indexMethod · 0.80

Calls 5

convert_to_bool_sortMethod · 0.80
solve_expressionMethod · 0.80
resetMethod · 0.80

Tested by

no test coverage detected