Skip to content

Skip integer overflow check for pointer difference - #9229

Merged
kroening merged 1 commit into
diffblue:developfrom
tautschnig:kiro/9210-ptrdiff-overflow
Oct 21, 2026
Merged

kroening merged 1 commit into
diffblue:developfrom
tautschnig:kiro/9210-ptrdiff-overflow

Conversation

@tautschnig

Copy link
Copy Markdown
Collaborator

The integer_overflow_check in check_rec_arithmetic_op builds
overflow-(p, q) for a pointer subtraction q - p, which tests the
operand type (unsigned/pointer) rather than the result type
(ptrdiff_t). This incorrectly flags q - p as overflowing whenever
q < p, even though the result is always representable in ptrdiff_t
when both pointers are into the same array.

Skip the integer overflow check for pointer differences. The
pointer-arithmetic bounds checks already verify that both operands
are within the same object.

Fixes #9210

  • Each commit message has a non-empty body, explaining why the change was made.
  • n/a Methods or procedures I have added are documented, following the guidelines provided in CODING_STANDARD.md.
  • n/a The feature or user visible behaviour I have added or modified has been documented in the User Guide in doc/cprover-manual/
  • Regression or unit tests are included, or existing tests cover the modified code (in this case I have detailed which ones those are in the commit message).
  • n/a My commit message includes data points confirming performance improvements (if claimed).
  • My PR is restricted to a single feature or bugfix.
  • White-space or formatting changes outside the feature-related changed lines are in commits of their own.

The integer_overflow_check in check_rec_arithmetic_op builds
overflow-(p, q) for a pointer subtraction q - p, which tests the
operand type (unsigned/pointer) rather than the result type
(ptrdiff_t).  This incorrectly flags q - p as overflowing whenever
q < p, even though the result is always representable in ptrdiff_t
when both pointers are into the same array.

Skip the integer overflow check for pointer differences.  The
pointer-arithmetic bounds checks already verify that both operands
are within the same object.

Fixes diffblue#9210

Co-authored-by: Kiro <kiro-agent@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 20, 2026 19:39

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

@codecov

codecov Bot commented Oct 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.90%. Comparing base (266f438) to head (5a591ce).

Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #9229      +/-   ##
===========================================
- Coverage    80.91%   80.90%   -0.02%     
===========================================
  Files         1718     1718              
  Lines       190266   190270       +4     
  Branches        73       73              
===========================================
- Hits        153952   153934      -18     
- Misses       36314    36336      +22     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@kroening
kroening merged commit 8fcda33 into diffblue:develop Oct 21, 2026
42 of 43 checks passed
@tautschnig
tautschnig deleted the kiro/9210-ptrdiff-overflow branch October 22, 2026 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Default signed-overflow check reports a false overflow for in-bounds pointer subtraction q - p when q < p

3 participants