Polyspace Overflow Orange Checks

Hello guys,

I have this C++ code:

#include <iostream>

using namespace std;

int pos = 0;

char *buf = NULL;

const char *module_name = "module";

void myfunc()

{

pos += snprintf(buf + pos, pos, "[%s] ", module_name);

}

The Polyspace Code Prover gives one Overflow Orange Check. I have also set the DRS but Orange Check still exists.

Can you help me how to remove the Orange Check beside giving annotation?

Thank you in advance.

Answer 1

[Anirban]

There are two reasons for the orange overflow:

• snprintf() can return a very large number.
• myfunc() can be called 0 or more times, upto a very large number. There is no main() function which would indicate how many times myfunc() is called (that is, your application is not complete).

By applying DRS, you have constrained the return value of snprint(). But even if snprintf() returns something in a small range like 0..100, myfunc() can still be called 0 or more times.

Now the question is: do you want to get rid of the orange overflow or make your function robust to overflows? Just based on your code snippet, Polyspace is making sound assumptions and showing that the function is not robust to overflows. Any external constraint you apply would assume that you have some foreknowledge outside the code.

Since you are applying DRS, I will go with the assumption that you somehow have this foreknowledge. You can then also constrain the number of times myfunc() can be called. There is no way to do this directly in the user interface, but you can add a file to your Polyspace project with lines like this (this code snippet is saying that myfunc() is called upto 10 times):

extern void myfunc();
int generateRandomNumber();

void main() {
    int counter_max = generateRandomNumber();
    assert(counter_max > 0 && counter_max <=10);
    for(int i = 0; i < counter_max; i++)
        myfunc();
}

Name the file polyspace_main.cpp or whatever and add it to the analysis along with your current source (and also apply DRS on the return of snprint). Now, the overflow should go away, because you have constrained both aspects of the overflow.

[Zulham Mr]

Hi Anirban,

Thank you for your answer, it still shows the Orange Checks. Is it possible to set the DRS for the return value of stubbed function?

[Anirban]

Yes, it is possible to set DRS on the return value. What do you see when you hover on the += in the analysis results? To me, the right operand in the tooltip showed the narrower DRS range that I had applied.

[Zulham Mr]

This is what I see. I can't set the DRS for return value of stubbed function.

[Anirban]

You might have to contact MathWorks Technical Support for more help on this issue. With version R2022a, when I apply a permanent DRS range of 0..1 on the return of snprintf like this:

I see the following tooltip:

For completeness, I am also showing you the file polyspace_main.cpp, which implements the fact that func is called 0 to 9 times:

There is an orange check on the assert ofcourse, because at that point counter_max is unknown. If you want to remove this orange check, instead of assert, you can use unchecked_assert. The macro unchecked_assert is understood only by Polyspace, so it will not compile with your compiler. You can either put the line in a separate file that you do not provide to your compiler like I did, or you might have to put it in an #ifdef like this:

#ifdef POLYSPACE
 
unchecked_assert(counter_max > 0 && counter_max <= 10);

#endif

[Zulham Mr]

That's great. Thank you.