The sub-size of void* is undefined; use char* as specified in the standard

This patch includes a review of all uses of functions from pointer_offset_size.h
as all of those may return nil or a negative number if the size could not be
determined. Calling sites need to handle those cases as appropriate in a given
context.

Author: tautschnig

regression/cbmc/void_pointer1/main.c

@@ -0,0 +1,12 @@
+char buffer[2];
+int length = 2;
+
+void func(void* buf, int len)
+{
+  while( len-- )
+    *(char *)buf++;
+}
+
+void main(){
+  func(buffer,length);
+}

regression/cbmc/void_pointer1/test.desc

@@ -0,0 +1,8 @@
+CORE
+main.c
+--pointer-check
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring

regression/cbmc/void_pointer2/main.c

@@ -0,0 +1,12 @@
+char buffer[2];
+int length = 2;
+
+void func(void* buf, int len)
+{
+  while( len-- )
+    *(char *)buf++;
+}
+
+void main(){
+  func(buffer,length);
+}

regression/cbmc/void_pointer2/test.desc

@@ -0,0 +1,8 @@
+CORE
+main.c
+--pointer-check --no-simplify --unwind 3
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring

src/analyses/goto_rw.cpp

@@ -149,6 +149,7 @@ void rw_range_sett::get_objects_complex(
 
   range_spect sub_size=
     to_range_spect(pointer_offset_bits(op.type().subtype(), ns));
+  assert(sub_size>0);
   range_spect offset=
     (range_start==-1 || expr.id()==ID_complex_real) ? 0 : sub_size;
 

src/ansi-c/c_typecheck_expr.cpp

@@ -1318,8 +1318,8 @@ void c_typecheck_baset::typecheck_expr_typecast(exprt &expr)
     // an integer/float of the same size
     if((expr_type.id()==ID_signedbv ||
         expr_type.id()==ID_unsignedbv) &&
-       pointer_offset_size(expr_type, *this)==
-       pointer_offset_size(op_vector_type, *this))
+       pointer_offset_bits(expr_type, *this)==
+       pointer_offset_bits(op_vector_type, *this))
     {
     }
     else

src/ansi-c/padding.cpp

@@ -339,6 +339,9 @@ void add_padding(union_typet &type, const namespacet &ns)
   mp_integer max_alignment=alignment(type, ns)*8;
   mp_integer size_bits=pointer_offset_bits(type, ns);
 
+  if(size_bits<0)
+    throw "type of unknown size:\n"+type.pretty();
+
   union_typet::componentst &components=type.components();
 
   // Is the union packed?

src/goto-instrument/alignment_checks.cpp

@@ -60,6 +60,9 @@ void print_struct_alignment_problems(
           const namespacet ns(symbol_table);
           mp_integer size=pointer_offset_size(it_type, ns);
 
+          if(size<0)
+            throw "type of unknown size:\n"+it_type.pretty();
+
           cumulated_length+=size;
           // [it_mem;it_next] cannot be covered by an instruction
           if(cumulated_length>config.ansi_c.memory_operand_size)
@@ -99,6 +102,9 @@ void print_struct_alignment_problems(
       const mp_integer size=
         pointer_offset_size(array.subtype(), ns);
 
+      if(size<0)
+        throw "type of unknown size:\n"+it_type.pretty();
+
       if(2*integer2long(size)<=config.ansi_c.memory_operand_size)
       {
         out << "\nWARNING: "

src/pointer-analysis/value_set.cpp

@@ -717,10 +717,23 @@ void value_sett::get_value_set_rec(
 
       if(i_is_set)
       {
-        i*=pointer_offset_size(ptr_operand.type().subtype(), ns);
+        typet pointer_sub_type=ptr_operand.type().subtype();
+        if(pointer_sub_type.id()==ID_empty)
+          pointer_sub_type=char_type();
 
-        if(expr.id()==ID_minus)
-          i.negate();
+        mp_integer size=pointer_offset_size(pointer_sub_type, ns);
+
+        if(size<=0)
+        {
+          i_is_set=false;
+        }
+        else
+        {
+          i*=size;
+
+          if(expr.id()==ID_minus)
+            i.negate();
+        }
       }
 
       get_value_set_rec(
@@ -1155,7 +1168,14 @@ void value_sett::get_reference_set_rec(
         }
         else if(!to_integer(offset, i) &&
                 o.offset_is_zero())
-          o.offset=i*pointer_offset_size(array_type.subtype(), ns);
+        {
+          mp_integer size=pointer_offset_size(array_type.subtype(), ns);
+
+          if(size<=0)
+            o.offset_is_set=false;
+          else
+            o.offset=i*size;
+        }
         else
           o.offset_is_set=false;
 

src/pointer-analysis/value_set_dereference.cpp

@@ -566,6 +566,10 @@ value_set_dereferencet::valuet value_set_dereferencet::build_reference_to(
         // no need to adjust offset
         adjusted_offset=offset;
       }
+      else if(element_size<=0)
+      {
+        throw "unknown or invalid type size of:\n"+dereference_type.pretty();
+      }
       else
       {
         exprt element_size_expr=
@@ -965,7 +969,12 @@ bool value_set_dereferencet::memory_model_bytes(
     // upper bound
     {
       mp_integer from_width=pointer_offset_size(from_type, ns);
+      if(from_width<=0)
+        throw "unknown or invalid type size:\n"+from_type.pretty();
+
       mp_integer to_width=pointer_offset_size(to_type, ns);
+      if(to_width<=0)
+        throw "unknown or invalid type size:\n"+to_type.pretty();
 
       exprt bound=from_integer(from_width-to_width, offset.type());