(
&self,
path: Rc<Path>,
val_ty: Ty<'tcx>,
abstract_value: &AbstractDomain<DomainType>,
)
| 191 | } |
| 192 | |
| 193 | pub fn check_within_range( |
| 194 | &self, |
| 195 | path: Rc<Path>, |
| 196 | val_ty: Ty<'tcx>, |
| 197 | abstract_value: &AbstractDomain<DomainType>, |
| 198 | ) -> CheckerResult { |
| 199 | let solver = &self.body_visitor.z3_solver; |
| 200 | Self::add_numerical_constraints(&solver, abstract_value); |
| 201 | |
| 202 | let exp_type: ExpressionType = val_ty.kind().into(); |
| 203 | |
| 204 | // First solve `var <= max` and `var >= min` |
| 205 | let mut exp = LinearExpression::default(); |
| 206 | exp = exp - exp_type.max_value_int() + path.clone(); |
| 207 | let cst1 = LinearConstraint::LessEq(exp); |
| 208 | |
| 209 | let mut exp = LinearExpression::default(); |
| 210 | exp = exp + exp_type.min_value_int() - path; |
| 211 | let cst2 = LinearConstraint::LessEq(exp); |
| 212 | |
| 213 | let within_range_cond = solver.make_and_z3_expression(&cst1, &cst2); |
| 214 | |
| 215 | let result; |
| 216 | match solver.solve_expression(&within_range_cond) { |
| 217 | SmtResult::Unsat => { |
| 218 | // value is not within the valid range |
| 219 | result = CheckerResult::Unsafe; |
| 220 | } |
| 221 | SmtResult::Sat => { |
| 222 | // value may be within the valid range, now check whether `not within the range` is always false |
| 223 | if solver.solve_expression(&solver.make_not_z3_expression(within_range_cond)) |
| 224 | == SmtResult::Unsat |
| 225 | { |
| 226 | // `not within the range` is always false, so `value is within the range` is always true |
| 227 | result = CheckerResult::Safe; |
| 228 | } else { |
| 229 | result = CheckerResult::Warning; |
| 230 | } |
| 231 | } |
| 232 | SmtResult::Unknown => { |
| 233 | result = CheckerResult::Warning; |
| 234 | } |
| 235 | } |
| 236 | solver.reset(); |
| 237 | result |
| 238 | } |
| 239 | |
| 240 | fn check_overflow( |
| 241 | &mut self, |
no test coverage detected