Skip to content

Conversation

@feliperodri
Copy link
Contributor

@feliperodri feliperodri commented May 21, 2021

Issue #, if available:
N/A.

Description of changes:
This PR contains two changes:

  1. Avoid null-pointer arithmetic.
  2. Disable pointer-overflow check for slow proofs.

We have run CBMC 5.30.1 on all proofs in ESDK-C. We must fix these issues before we update CBMC version in CI.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Check any applicable:

  • Were any files moved? Moving files changes their URL, which breaks all hyperlinks to the files.

@feliperodri feliperodri added the cbmc CBMC proof related work label May 21, 2021
@feliperodri feliperodri self-assigned this May 21, 2021
@feliperodri feliperodri requested a review from robin-aws May 21, 2021 19:22
@feliperodri
Copy link
Contributor Author

Ref.: #704

@feliperodri feliperodri requested a review from alex-chew May 21, 2021 19:28
Copy link
Contributor

@robin-aws robin-aws left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you mind adding a bit more context to the PR description (and hence the actual commit) about this being for forwards compatibility with CBMC 5.29?

PROOF_SOURCES += $(PROOF_SOURCE)/make_common_data_structures.c
###########

REMOVE_FUNCTION_BODY += aws_byte_cursor_advance
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to double check my understanding: this just makes these functions opaque to CBMC, which happens to make the proof less expensive?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This improves our coverage metric, by discarding functions that are unreachable for this proof. The else branch in field_sized is unreachable, so these functions are never called; however, our coverage analysis still considers this path in the coverage metric. By removing this unreachable functions, we improve coverage metric. If they ever become reachable, our report will through a warning.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Of the function bodies removed here, it looks like only aws_byte_cursor_advance appears directly in the else branch in question. Is it sufficient to remove just that function body, or do we need to manually list all the other functions that are transitively called, as done here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@alex-chew we only need to specify the functions that are directly included in the path, you're correct. I updated the list of these function for the aws_cryptosdk_serialize_frame proof and add a comment explaining why we do this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws_byte_cursor_read_be32 and aws_byte_cursor_read_be64 functions are included in the coverage metric because of field_helper, but we also never reach the else branch there either.

@feliperodri feliperodri merged commit bbb38a0 into aws:master May 21, 2021
@feliperodri feliperodri deleted the avoid-null-arithmetic branch August 12, 2021 04:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cbmc CBMC proof related work

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants