From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=d7IE=7N=gmail.com=kumom.huang@sourceware.org>
Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d])
	by sourceware.org (Postfix) with ESMTPS id 9FA4C3858D37
	for <gcc@gcc.gnu.org>; Tue, 21 Mar 2023 10:12:46 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 9FA4C3858D37
Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com
Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com
Received: by mail-ed1-x52d.google.com with SMTP id r11so57494135edd.5
        for <gcc@gcc.gnu.org>; Tue, 21 Mar 2023 03:12:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112; t=1679393565;
        h=references:to:cc:in-reply-to:date:subject:mime-version:message-id
         :from:from:to:cc:subject:date:message-id:reply-to;
        bh=qXVOWWP0Hu6O8oYljpZIqizFBqxkscbwACXLzeVQGTI=;
        b=d7Z3sZ/kI7oBXTZh4YWhsitarBOiwcxrX9J89Tynd+leUJGNmbZvxpYVapjFFUeX+/
         VEFb5ucqWxJcbod6imCRnjjjTxX2qh4E9Ge5zm8k5pL1T2wOyZg9TKS/VrGNBWR4OZtL
         tdJH4xZC3o3V3K68Rb4mSGE6OLxyBVhnnBCMxq+Do8lqWZcFhHaQMI63Dh9NIjWMS3yN
         egpH1hCYHj4aa28SESzCKXff7WRIt5ipxaWhq0d6CV9QW0D6U5deWtRo2rZOpvzE03VM
         VwOnZBUz8byfgmsmw4Hy+7PNzDWyymYnmdgpFwQM4iZk2uN+//tGh62msnij8gqMJu4g
         sfxw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112; t=1679393565;
        h=references:to:cc:in-reply-to:date:subject:mime-version:message-id
         :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
        bh=qXVOWWP0Hu6O8oYljpZIqizFBqxkscbwACXLzeVQGTI=;
        b=i/BzgHotqbHMbciyZPu6rMnZxMVtgCJ3ER0DE7A6ZSB5PAzLN7Mg1LxwthLGnRlFU7
         DBrGu56QzEnlCXZZI6RoYIGivK0dhgnjlESP670reC+urLhW1rEoKvLbpRSnXaNhgC+d
         vcfaiQ7vSCxWibQr3Nvw2CnlCyaY9uampKPWotykOEjBr4UHjzAuwtA/cq+b0XDS3Tdr
         TNXjF1d5Z96XSxX138eGE5IK0P9wzgkuXKzEBhZGlafhuvbRp43kdSBQDLM4RhXxYhmr
         vwuZExL2DkfiYKOMAsBEUTb768So6xq9wAfPB72mklggvukMnz13Jg1lFmJ6TbxoL9i6
         2IiQ==
X-Gm-Message-State: AO0yUKU24IsSeB0N8x08JRWUf9DOl82UG3s5hkUXuspNZWrCePsIhK6U
	GeeK9vloC2E496LNB8DSjEeEjj0qKHTZCA==
X-Google-Smtp-Source: AK7set+buitFcBea7MNqdBdxDzetV9aZevH69vUhhXfABQp508zfYEBnNC8AhGnsfQ+OkS3TOvANdA==
X-Received: by 2002:a17:906:5857:b0:88a:cbd1:e663 with SMTP id h23-20020a170906585700b0088acbd1e663mr2668588ejs.6.1679393565113;
        Tue, 21 Mar 2023 03:12:45 -0700 (PDT)
Received: from smtpclient.apple ([2001:620:618:5c8:2:80b3:0:6d8])
        by smtp.gmail.com with ESMTPSA id 8-20020a170906300800b008e2dfc6382asm5565064ejz.125.2023.03.21.03.12.44
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 21 Mar 2023 03:12:44 -0700 (PDT)
From: Shengyu Huang <kumom.huang@gmail.com>
Message-Id: <64B0D3A9-0DC4-4900-ACA2-C36B8FBEADF5@gmail.com>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_C2CF552D-286E-4C9A-BBD4-BABAAFD493E6"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.200.110.1.12\))
Subject: Re: [Static Analyzer] Loop handling - False positive for malloc-sm
Date: Tue, 21 Mar 2023 11:12:33 +0100
In-Reply-To: <3b77234afb96947c9694d375b43b3096cbd45467.camel@redhat.com>
Cc: GCC Development <gcc@gcc.gnu.org>
To: David Malcolm <dmalcolm@redhat.com>
References: <34efc6e0-5bd8-879c-0288-154ba28f5f05@irisa.fr>
 <3b77234afb96947c9694d375b43b3096cbd45467.camel@redhat.com>
X-Mailer: Apple Mail (2.3731.200.110.1.12)
X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org
List-Id: <gcc.gcc.gnu.org>


--Apple-Mail=_C2CF552D-286E-4C9A-BBD4-BABAAFD493E6
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hi Dave,

> On 21 Mar 2023, at 00:30, David Malcolm via Gcc <gcc@gcc.gnu.org> wrote:
>=20
> I implemented my own approach, with a "widening_svalue" subclass of
> symbolic value.  This is widening in the Abstract Interpretation sense,
> (as opposed to the bitwise operations sense): if I see multiple values
> on successive iterations, the widening_svalue tries to simulate that we
> know the start value and the direction the variable is moving in.

I forgot to mention there is a relevant section =E2=80=9Cpath selection=E2=
=80=9D in the paper I mentioned several times (https://users.ece.cmu.edu/~a=
avgerin/papers/Oakland10.pdf).=20=

--Apple-Mail=_C2CF552D-286E-4C9A-BBD4-BABAAFD493E6--