2
2
3
3
### Example: Buffer Overflows
4
4
5
- In order to give a brief overview of the capabilities of CBMC
6
- we start with a small example. The issue of * [ buffer
5
+ To give a brief overview of the capabilities of CBMC
6
+ we start with a simple example. The issue of * [ buffer
7
7
overflows] ( http://en.wikipedia.org/wiki/Buffer_overflow ) * has obtained
8
- wide public attention. A buffer is a contiguously- allocated chunk of
8
+ wide public attention. A buffer is a contiguously allocated chunk of
9
9
memory, represented by an array or a pointer in C. Programs written in C
10
10
do not provide automatic bounds checking on the buffer, which means a
11
- program can – accidentally or maliciously – write past a buffer. The
11
+ program can – accidentally or deliberately – write beyond a buffer. The
12
12
following example is a perfectly valid C program (in the sense that a
13
13
compiler compiles it without any errors):
14
14
@@ -25,7 +25,7 @@ region can lead to unexpected behavior. In particular, such bugs can be
25
25
exploited to overwrite the return address of a function, thus enabling
26
26
the execution of arbitrary user-induced code. CBMC is able
27
27
to detect this problem and reports that the "upper bound property" of
28
- the buffer is violated. CBMC is capable of checking these
28
+ the buffer has been violated. CBMC is capable of checking these
29
29
lower and upper bounds, even for arrays with dynamic size. A detailed
30
30
discussion of the properties that CBMC can check
31
31
automatically is \ref man_instrumentation-properties "here".
@@ -58,7 +58,7 @@ int main(int argc, char **argv)
58
58
59
59
Of course, this program is faulty, as the `argv` array might have fewer
60
60
than three elements, and then the array access `argv[2]` is out of
61
- bounds. Now, run CBMC as follows :
61
+ bounds. Now, run CBMC:
62
62
63
63
```
64
64
cbmc file1.c --show-properties --bounds-check --pointer-check
@@ -106,8 +106,7 @@ to a SAT solver (more background on this step is in the book on
106
106
[Decision Procedures](http://www.decision-procedures.org/)). It then
107
107
determines which of the properties that it has generated for the program
108
108
hold and which do not. Using the SAT solver, CBMC detects that the
109
- property for the object bounds of `argv` does not hold, and will thus
110
- print a line as follows:
109
+ property for the object bounds of `argv` does not hold, and will display:
111
110
112
111
```plaintext
113
112
[main.pointer_dereference.6] dereference failure: pointer outside object bounds in argv[(signed long int)2]: FAILURE
@@ -117,11 +116,11 @@ print a line as follows:
117
116
118
117
Let us have a closer look at this property and why it fails. To aid the
119
118
understanding of the problem, CBMC can generate a * counterexample trace*
120
- for failed properties. To obtain this trace, run
119
+ for failed properties. To obtain this trace, run:
121
120
122
121
cbmc file1.c --bounds-check --trace
123
122
124
- CBMC then prints a counterexample trace, i.e. , a program trace that
123
+ CBMC then prints a counterexample trace, that is , a program trace that
125
124
begins with ` main ` and ends in a state which violates the property. In
126
125
our example, the program trace ends in the faulty array access. It also
127
126
gives the values the input variables must have for the bug to occur. In
@@ -149,7 +148,7 @@ int sum() {
149
148
}
150
149
```
151
150
152
- In order to set the entry point to the ` sum ` function, run
151
+ To set the entry point to the ` sum ` function, run:
153
152
154
153
``` plaintext
155
154
cbmc file2.c --function sum --bounds-check
@@ -274,7 +273,7 @@ the argument is too small, CBMC will detect that not enough unwinding is
274
273
done reports that an unwinding assertion has failed.
275
274
276
275
Reconsider the example. For a loop unwinding bound of one, no bug is
277
- found. But already for a bound of two, CBMC detects a trace that
276
+ found. But for a bound of two, CBMC detects a trace that
278
277
violates an assertion. Without unwinding assertions, or when using the
279
278
` --depth ` command line switch, CBMC does not prove the program correct,
280
279
but it can be helpful to find program bugs. The various command line
@@ -292,7 +291,7 @@ requirements:
292
291
contain * declarations* of the functions that are to be used.
293
292
2 . Appropriate * definitions* have to be provided.
294
293
295
- Most C compilers come with header files for the ANSI- C library
294
+ Most C compilers come with header files for the ANSI C library
296
295
functions. We briefly discuss how to obtain/install these library files.
297
296
298
297
#### Linux
0 commit comments