[ 0:01] compiling /var/obj/divine-nightly/semidbg/test/_expand/svcomp/loops/MADWiFi-encode_ie_ok_true.pkg.c/small.10.c [ 0:01] compiling /dios/lib/config/seqklee.bc [ 0:01] setting up pass: functionmeta, options = [ 0:02] setting up pass: fuse-ctors, options = [ 0:02] KLEE: output directory is "/var/obj/divine-nightly/semidbg/test/__test_work_dir.2/_klee_out" [ 0:04] KLEE: Using Z3 solver backend [ 0:04] WARNING: this target does not support the llvm.stacksave intrinsic. [ 0:04] warning: Linking two modules of different target triples: klee_div_zero_check.bc' is 'x86_64-unknown-linux-gnu' whereas 'klee.bc' is 'x86_64-unknown-none-elf' [ 0:04] [ 0:04] KLEE: WARNING: undefined reference to function: __dios_tainted_init [ 0:07] KLEE: WARNING: undefined reference to function: klee_free [ 0:07] KLEE: WARNING: undefined reference to function: klee_malloc [ 0:07] about to __boot:0 [ 0:07] KLEE: WARNING ONCE: Alignment of memory from call "klee_malloc" is not modelled. Using alignment of 8. [ 0:07] about to run the scheduler:0 [ 0:07] KLEE: WARNING ONCE: calling external: __dios_tainted_init() at /dios/libc/sys/start.cpp:49 5 [ 0:07] KLEE: ERROR: /dios/libc/sys/start.cpp:87: failed external call: __dios_tainted_init [ 0:07] KLEE: NOTE: now ignoring this error at this location [ 0:07] KLEE: ERROR: EXITING ON ERROR: [ 0:07] Error: failed external call: __dios_tainted_init [ 0:07] File: /dios/libc/sys/start.cpp [ 0:07] Line: 87 [ 0:07] assembly.ll line: 34194 [ 0:07] Stack: [ 0:07] #000034194 in __dios_start (l=0, argc=1, argv=94407401865224, envp=94407401883656) at /dios/libc/sys/start.cpp:87 [ 0:07] #100010213 in _ZN6__dios10sched_nullINS_5ClockINS_10NondetKleeINS_4BaseEEEEEE13run_schedulerINS_7ContextEEEvv () at /dios/sys/sched_null.hpp:163 [ 0:07] #200042544 in klee_boot (argc=1, argv=94407388989504) at /dios/arch/klee/boot.c:41 [ 0:07] [ 0:07] [ 0:07] 1 /* TAGS: c sym */ [ 0:07] 2 /* VERIFY_OPTS: --symbolic */ [ 0:07] 3 /* CC_OPTS: -DNUM=10 */ [ 0:07] 4 [ 0:07] 5 // V: small.10 CC_OPT: -DNUM=10 [ 0:07] 6 // V: small.100 CC_OPT: -DNUM=100 [ 0:07] 7 // V: big.1000 CC_OPT: -DNUM=1000 TAGS: big [ 0:07] 8 // V: big.10000 CC_OPT: -DNUM=10000 TAGS: big [ 0:07] 9 // V: big.100000 CC_OPT: -DNUM=100000 TAGS: big [ 0:07] 10 [ 0:07] 11 extern void __VERIFIER_error(void); [ 0:07] 12 extern void __VERIFIER_assume(int); [ 0:07] 13 void __VERIFIER_assert(int cond) { [ 0:07] 14 if (!(cond)) { [ 0:07] 15 ERROR: __VERIFIER_error(); [ 0:07] 16 } [ 0:07] 17 return; [ 0:07] 18 } [ 0:07] 19 int __VERIFIER_nondet_int(); [ 0:07] 20 [ 0:07] 21 int main() [ 0:07] 22 { [ 0:07] 23 /* buf is treated as an array of unsigned 8-byte ints */ [ 0:07] 24 // u_int8_t *p; [ 0:07] 25 int p; [ 0:07] 26 int i; [ 0:07] 27 int leader_len; [ 0:07] 28 int bufsize; [ 0:07] 29 int bufsize_0; [ 0:07] 30 int ielen; [ 0:07] 31 [ 0:07] 32 leader_len = __VERIFIER_nondet_int(); [ 0:07] 33 bufsize = __VERIFIER_nondet_int(); [ 0:07] 34 ielen = __VERIFIER_nondet_int(); [ 0:07] 35 if (!(leader_len < NUM)) return 0; [ 0:07] 36 if (!(bufsize < NUM)) return 0; [ 0:07] 37 if (!(ielen < NUM)) return 0; [ 0:07] 38 [ 0:07] 39 // copy the contents of leader into buf [ 0:07] 40 if(leader_len >0); else goto END; [ 0:07] 41 if(bufsize >0); else goto END; [ 0:07] 42 if(ielen >0); else goto END; [ 0:07] 43 [ 0:07] 44 if (bufsize < leader_len) [ 0:07] 45 goto END; [ 0:07] 46 [ 0:07] 47 p = 0; [ 0:07] 48 [ 0:07] 49 bufsize_0 = bufsize; [ 0:07] 50 bufsize -= leader_len; [ 0:07] 51 p += leader_len; [ 0:07] 52 [ 0:07] 53 /* This is the fix. */ [ 0:07] 54 if (bufsize < 2*ielen) [ 0:07] 55 goto END; [ 0:07] 56 [ 0:07] 57 for (i = 0; i < ielen && bufsize > 2; i++) { [ 0:07] 58 __VERIFIER_assert(0<=p); [ 0:07] 59 __VERIFIER_assert(p+1