mirror of
https://github.com/Z3Prover/z3
synced 2026-07-27 01:12:40 +00:00
0790dfd876
reduce_core looped with while (true) and read p = todo.back() with no empty check, exiting only when it reached a hypothesis-free sub-proof of false. When hypothesis reduction cannot close all hypotheses on the root proof, todo drains and todo.back() reads past the end of the vector, producing a heap-use-after-free (SIGSEGV in Fixedpoint.query with spacer.keep_proxy=false). Whether the root closes depends on search order, making the crash nondeterministic / seed-dependent. Bound the loop by todo emptiness, track the reduced root across cache-hit pops, and return it if the loop drains without hitting the false-subproof early return. Verified on the issue #10123 benchmark: the UAF is eliminated across spacer.random_seed 0/3/7/13/42/99, all returning unsat. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 726c4e71-03ff-45f6-8322-5253254e1d7e |
||
|---|---|---|
| .. | ||
| base | ||
| bmc | ||
| clp | ||
| dataflow | ||
| ddnf | ||
| fp | ||
| rel | ||
| spacer | ||
| tab | ||
| transforms | ||
| README | ||
muZ: routines related to solving satisfiability of Horn clauses and
solving Datalog programs.
- base - contains base routines and the main context for
maintaining fixedpoint solvers
- transforms - common rule transformations
- rel - relational algebra based Datalog engine
- pdr - PDR based Horn clause solver
- clp - Dart/Symbolic execution-based solver
- tab - Tabulation based solver
- bmc - Bounded model checking based solver
- fp - main exported routines