Repository navigation
fix: complete WP proofs for five string algorithms - #19
Merged
Merged
Conversation
Keep the current WP proof helpers while integrating the prefix and copy postconditions from PR #10. Move the contract to the header and bound its frame by the actual truncated copy, including the terminator. WP proves 129/129 goals with RTE under the documented unsigned-wraparound policy; all 30 smoke tests pass. The executable algorithm is unchanged. PR: #10
Port the search contract and skipped-prefix invariant to stock WP. Cover empty needles, the first matching offset, and absence of a match without requiring the haystack to end in NUL. Keep memcmp's verified contract and the current WP session layout instead of restoring AstraVer artifacts. WP proves 112/112 goals with RTE under the documented unsigned-wraparound policy; all 26 smoke tests pass. The executable algorithm is unchanged. PR: #11
Keep the proved cursor invariants instead of the older broad loop frame. Move the named contract to the header and restrict writes to the suffix through the actual appended terminator. PR #11 is already integrated, so its inherited changes do not restore the old strnstr proof or session. WP proves 311/311 goals with RTE under the documented unsigned-wraparound policy; all 66 smoke tests pass. The executable algorithm is unchanged. PR: #12
Replace the incorrect normalized-length behaviors with an exact common prefix and termination predicate. This covers unequal strings and the repeated-newline case: "x\n" and "x\n\n" compare equal. Remove the unused sysfs_strlen helpers and preserve the repaired shared strncmp definitions. WP proves 166/166 goals with RTE under the documented unsigned-wraparound policy; all 25 smoke tests pass. The executable algorithm is unchanged. The goal count drops because the old contract and helper chain are gone. PR: #13
Describe a readable prefix ending at n or the first NULL, with a length that fits the int index. This admits the documented (size_t)-1 sentinel mode without permitting signed overflow. State the first-match and missing-result properties directly instead of recursive array models. Turn strcmp_corollary into a proved ghost function and call it explicitly. Its conditional postcondition covers equal strings too, keeping both proof branches reachable. Update the obsolete lemma notes in the READMEs. WP proves 193/193 goals with RTE under the documented unsigned-wraparound policy; all 45 smoke tests pass. The executable algorithm is unchanged. PR: #14
Add 45 boundary assertions to the existing DUMMY_MAIN harnesses for the five integrated algorithms. The existing make run and CI steps run them. Disable compiler builtins so the harnesses exercise the implementations. Propagate failures from make run and make the strlen and strnlen examples assert their results instead of returning lengths as exit statuses. Validation: make build and make run pass. All seven changed harnesses pass ASan/UBSan, and an injected failure stops make run. The preprocessed proof inputs, algorithm bodies and specifications are unchanged.
Collect the proof cache and reports for strlcat, strnstr, strncat, sysfs_streq and match_string after their specification and harness changes. Keep generated proof artifacts out of the individual source commits. These unchanged artifacts prove 911/911 WP goals for the five algorithms under the existing unsigned-arithmetic policy. The full 35-function replay and all 192 smoke checks passed before this history-only rewrite.
This was referenced Sep 18, 2026
Closed
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integrate the specification work from #10, #11, #12, #13 and #14 into the
current Frama-C/WP setup, repair incomplete or incorrect contracts, and
prove all five algorithms without changing their executable bodies.
The contracts now cover truncated concatenation, the first bounded
substring match, the exact append frame, trailing-newline comparisons,
and the first match in bounded or NULL-terminated string arrays. Replace
the unresolved strcmp_corollary lemma with a proved ghost function.
Reuse the existing main() harnesses for 45 boundary assertions. Make
make run propagate failures and disable compiler builtins so the harnesses
exercise the repository implementations. Correct the strlen and strnlen
harness exit statuses as well.
Validation:
and downcasts; 911/911 goals and 192/192 smoke checks pass.
History is linear: five specification commits, one harness commit, and
one final commit containing all sessions/ cache and report changes.