Question: the path of SVFG for branches

[ZcoderL]

When using Saber to test this test code, the expected results were not obtained
my codes：

#include<stdlib.h>
typedef struct Node {
    int data;           
    struct Node *next;  
} Node;
int main() {
    Node* head1 = (Node*)malloc(sizeof(Node)); 
    Node* head2 = (Node*)malloc(sizeof(Node)); 
    int a = 1;
    int b = 1;
    Node *p = head1;
    if(a == b){
        p = head2;
    }
    free(p);
    return 0;
}

The correct result should be that both head1 and head2 report PartialLeaf

But the test results show that head1 has no memory leak, while head2 reports PartialLeak

I checked the slice diagram and found that the path from the malloc node of head1 to the free node did not pass through if...then block, may I ask why this is?

[yuleisui]

@jumormt could you have a look?

[jumormt]

This case is tricky. Different from head2, the conditional free path for head1 should be the if-else branch. It seems that the value-flow guard between p@Line 11 and p@Line 15 should be a != b instead of a true value.

Regarding why head1 does not pass through the if-then block, the points-to set of head1@Line 11 does not pass to p@Line 13 (i.e., no indirect value-flow between p@Line 11 and p@Line 13) because it is a strong update at Line 13. Therefore, saber removes that redundant indirect value-flow.

[yuleisui]

@ZcoderL could you upload the c file and its svfg? @jumormt the strong update should remove 11->13 but should keep 11->15 and the value-flow guard should have a condition a!=b?

[jumormt]

Yes, 11->13 is removed due to a strong update. 11->15 is a normal direct def-use and is kept in SVFG. The source code with line number:

And the SVFG (relevant part):

The entire SVFG:

[yuleisui]

The value-flow guard for 11-15 is missing? If not missing, there is supposed to be a conditional free?

[yuleisui]

@ZcoderL could you try the recent merge and see whether it fixes your issue?
#1309

[ZcoderL]

Due to the holiday a few days ago, I didn't see your reply, sorry.

Your update fixes my issue, thank you