\chapter{ANSI-C Language Features}

\label{ansi_c_language_features_sec}

\section{Basic Datatypes}

\cbmc{} supports the scalar data types as defined by the ANSI-C standard,
including {\tt \_Bool}. By default {\tt int} is 32 bits wide, {\tt short int}
is 16 bits wide, and {\tt char} is 8 bits wide. Using a command line option,
these default widths can be changed. By default, {\tt char} is signed. Since
some architectures use an unsigned {\tt char} type, a command line option
allows to change this setting.

There is also support for the floating point data types {\tt float}, {\tt
double}, and {\tt long double}. By default, \cbmc{} uses fixed-point
arithmetic for these types. Variables of type {\tt float} have by default 32
bits (16 bits integer part, 16 bits fractional part), variables of type {\tt
double} and {\tt long double} have 64 bits.

In addition to the types defined by the ANSI-C standard, \cbmc{} supports
the following Microsoft C extensions: {\tt \_\_int8}, {\tt \_\_int16}, {\tt
\_\_int32}, {\tt \_\_int64}. These types define a bit vector with the given number
of bits.

\section{Operators}

\subsection{Boolean Operators}

\cbmc{} supports all ANSI-C Boolean operators on scalar variables {\tt a},
{\tt b}:
%
\begin{center}
\begin{tabular}{c|l}
Operator         & Description \\ \hline\hline
{\tt !a}         & negation \\ \hline
{\tt a \&\& b}   & and \\ \hline
{\tt a || b}     & or
\end{tabular}
\end{center}

\subsection{Integer Arithmetic Operators}

\cbmc{} supports all integer arithmetic operators on scalar variables {\tt a},
{\tt b}:
%
\begin{center}
\begin{tabular}{c|l}
Operator           & Description \\ \hline\hline
{\tt -a}           & unary minus, negation \\ \hline
{\tt a+b}          & sum \\ \hline
{\tt a-b}          & subtraction \\ \hline
{\tt a*b}          & multiplication \\ \hline
{\tt a/b}          & division \\ \hline
{\tt a\%b}         & remainder \\ \hline
{\tt a{<}{<}b}     & bit-wise left shift \\ \hline
{\tt a{>}{>}b}     & bit-wise right shift \\ \hline
{\tt a\&b}         & bit-wise and \\ \hline
{\tt a|b}          & bit-wise or \\ \hline
{\tt a\^{}b}       & bit-wise xor \\ \hline
{\tt a< b}         & relation \\ \hline
{\tt a<=b}         & relation \\ \hline
{\tt a> b}         & relation \\ \hline
{\tt a>=b}         & relation
\end{tabular}
\end{center}

Note that the multiplication, division, and reminder operators are
very expensive with respect to the size of the equation that is passed to
the SAT solver. Furthermore, the equations are hard to solve for all SAT
solvers known to us.

As an example, consider the following program:
%
\begin{alltt}
int main() \{
  unsigned char a, b;
  unsigned int result=0, i;

  a=nondet_uchar();
  b=nondet_uchar();
  
  for(i=0; i<8; i++)
    if((b>>i)&1)
      result+=(a<<i);
  
  assert(result==a*b);
\}
\end{alltt}

The program nondeterministically selects two 8-bit unsigned values, and
then uses shift-and-add to multiply them. It then asserts that the result
(i.e., the sum) matches {\tt a*b}. Although the resulting SAT instance has
only about 1400 variables, it takes 12 minutes to solve using Chaff.

\paragraph{Properties Checked}

Optionally, \cbmc{} allows checking for arithmetic overflow in case of signed
operands. In case of the division and the remainder operator, \cbmc{} checks
for division by zero. This check can be disabled using a command line
option.

As an example, the following program nondeterministically selects two
unsigned integers {\tt a} and {\tt b}. It then checks that either of them is
non-zero and then computes the inverse of {\tt a+b}:
%
\begin{alltt}
int main() \{
  unsigned int a, b, c;
  
  a=nondet_uint();
  b=nondet_uint();
 
  if(a>0 || b>0)
    c=1/(a+b);
\}
\end{alltt}

However, due to arithmetic overflow when computing the sum, the division can
turn out to be a division by zero. \cbmc{} generates a counterexample as
follows for the program above:
%
\begin{alltt}
Initial State
----------------------------------------------------
  c=0 (00000000000000000000000000000000)

State 1 file div_by_zero.c line 4 function main
----------------------------------------------------
  a=4294967295 (11111111111111111111111111111111)

State 2 file div_by_zero.c line 5 function main
----------------------------------------------------
  b=1 (00000000000000000000000000000001)

Failed assertion: division by zero file div_by_zero.c
line 8 function main
\end{alltt}

\subsection{Floating Point Arithmetic Operators}

\cbmc{} supports the following operators on variables of the types {\tt
float}, {\tt double}, and {\tt long double}:
%
\begin{center}
\begin{tabular}{c|l}
Operator           & Description \\ \hline\hline
{\tt -a}           & unary minus, negation \\ \hline
{\tt a+b}          & sum \\ \hline
{\tt a-b}          & subtraction \\ \hline
{\tt a*b}          & multiplication \\ \hline
{\tt a< b}         & relation \\ \hline
{\tt a<=b}         & relation \\ \hline
{\tt a> b}         & relation \\ \hline
{\tt a>=b}         & relation
\end{tabular}
\end{center}

Division is currently not supported. Note that the multiplication operator
is very expensive with respect to the size of the equation that is passed to
the SAT solver. Furthermore, the equations are hard to solve for all SAT
solvers known to us. \cbmc{} also supports type conversions to and from
integer types.

\subsection{The Comma Operator}

\cbmc{} supports the comma operator {\tt a, b}. The operands are evaluated
for potential side effects. The result of the operator is the right operand.

\subsection{Type Casts}

\cbmc{} has full support for arithmetic type casts. As an example, the
expression {\tt (unsigned char)i} for an integer {\tt i} is guaranteed to be
between 0 and 255 in case of an eight bit character type.

\paragraph{Properties Checked}

For the unsigned data types, the ANSI-C standard requires modulo semantics,
i.e., that no overflow exception occurs. Thus, overflow is not checked. For
signed data types, an overflow exception is permitted. Optionally, \cbmc{}
checks for such arithmetic overflows.

\subsection{Side Effects}

\cbmc{} allows all side effect operators with their respective semantics. This
includes the assignment operators ({\tt =}, {\tt +=}, etc.), and the pre-
and post- increment and decrement operators.

As an example, consider the following program fragment:
%
\begin{alltt}
  unsigned int i, j;

  i=j++;
\end{alltt}

After the execution of the program, the variable {\tt i} will contain the
initial value of {\tt j}, and {\tt j} will contain the initial value of {\tt
j} plus one. \cbmc{} generates the following equation from the program:
%
\begin{eqnarray*}
i_1 &=& j_0 \\
j_1 &=& j_0 + 1
\end{eqnarray*}

\cbmc{} performs the implicit type cast as required by the ANSI-C standard.
As an example, consider the following program fragment:
%
\begin{alltt}
  char c;
  int i;
  long l;

  l = c = i;
\end{alltt}

The value of {\tt i} is converted to the type of the assignment expression
{\tt c=i}, that is, {\tt char} type. The value of this expression is then
converted to the type of the outer assignment expression, that is, 
{\tt long int} type.

\paragraph{Ordering of Evaluation}

The ANSI-C standard allows arbitrary orderings for the evaluations of
expressions and the time the side-effect becomes visible. The only exceptions
are the operators {\tt \&\&}, {\tt ||}, and the trinary operator {\tt ?:}.
For the Boolean operators, the standard requires strict evaluation from left
to right, and that the evaluation aborts once the result is known. The
operands of the expression {\tt c ? x : y} must be evaluated as follows:
first, {\tt c} is evaluated. If {\tt c} is \textsf{true}, {\tt x} is
evaluated, and {\tt y} otherwise.

As an example, assume that a pointer {\tt p} in the following fragment may
point to either {\tt NULL} or a valid, active object. Then, an {\tt if}
statement as follows is valid, since the evaluation must be done from left
to right, and if {\tt p} points to NULL, the result of the Boolean AND is
known to be \textsf{false} and the evaluation aborts before {\tt p} is
dereferenced.
%
\begin{alltt}
  if(p!=NULL && *p==5) \{
    . . .

\end{alltt}

For other operators, such as addition, no such fixed ordering exists. As an
example, consider the following fragment:
%
\begin{alltt}
int g;

int f() \{
  g=1;
  ...
\}

...
  g=2;

  if(f()+g==1) \{
    ...

\end{alltt}
%
In this fragment, a global variable {\tt g} is assigned to by a function
{\tt f()}, and just before an {\tt if} statement. Furthermore, {\tt g} is
used in an addition expression in the condition of the {\tt if} statement
together with a call to {\tt f()}. If {\tt f()} is evaluated first, the
value of {\tt g} in the sum will be one, while it is two if {\tt g} is
evaluated first. The actual result is architecture dependent.

\paragraph{Properties Checked}

\cbmc{} models this problem as follows: One option allows setting a fixed
ordering of evaluation for all operators. The other option allows checking
for such artifacts: \cbmc{} asserts that no side-effect affects the value of
any variable that is evaluated with equal priority. This includes changes
made indirectly by means of pointers. In the example, this is realized by
write-protecting the variable {\tt g} during the execution of {\tt f}. This
rules out programs that show architecture dependent behavior due to the
ordering of evaluation. While such programs are still valid ANSI-C programs,
we do not believe that programs showing architecture dependent behavior are
desirable.

\subsection{Function calls}

\cbmc{} supports functions by inlining. No modular approach is done. \cbmc{}
preserves the locality of the parameters and the non-static local variables
by renaming.

As an example, the following program calls the functions {\tt f()} and {\tt
g()} twice. While {\tt f()} uses a static variable, which is not renamed
between calls, {\tt g()} uses a true local variable, which gets a new value
for each call.
%
\begin{alltt}
int f() \{
  static int s=0;

  s++;

  return s;
\}

int g() \{
  int l=0;

  l++;

  return l;
\}

int main() \{
  assert(f()==1); // first call to f
  assert(f()==2); // second call to f
  assert(g()==1); // first call to g
  assert(g()==1); // second call to g
\}
\end{alltt}

Recursion is implemented by finite unwinding, as done for {\tt while} loops.
\cbmc{} checks that enough unwinding is done by means of an {\it unwinding
assertion} (section \ref{loopsec} provides more details).

\section{Control Flow Statements}

\subsection{Conditional Statement}

\cbmc{} allows the use of the conditional statement as described in the
ANSI-C standard.

\paragraph{Properties Checked}

\cbmc{} generates a warning if the assignment operator is used as condition of
a control flow statement such as {\tt if} or {\tt while}.

\subsection{\tt return}

The {\tt return} statement without value is transformed into an equivalent
{\tt goto} statement. The target is the end of the function. The {\tt
return} statement with value is transformed into an assignment of the value
returned and the {\tt goto} statement to the end of the function.

\paragraph{Properties Checked}

\cbmc{} enforces that functions with a non-void return type return a value
by means of the return statement. The execution of the function must not end
by reaching the end of the function. This is realized by inserting {\tt
assert(FALSE);} at the end of the function. \cbmc{} reports an error trace
if this location is reachable.

As an example, consider the following fragment:
%
\begin{alltt}
int f() \{
  int c=nondet_int();

  if(c!=1)
    return c;
\}

int main() \{
  int i;
  i=f();
\}
\end{alltt}

In this fragment, {\tt f()} may exit without returning a value. \cbmc{}
produces the following counterexample:
%
\begin{alltt}
State 1 file no-return.c line 2 function f
----------------------------------------------------
  c=1 (00000000000000000000000000000001)

Failed assertion: end-of-function assertion
file no-return.c line 6 function f
\end{alltt}

\subsection{\tt goto}

While only few C programs make use of {\tt goto} statements, \cbmc{}
provides support for such programs. We distinguish forward and backward
jumps. In case of backward jumps, the same technique used for loops is
applied: the loop is unwound a given number of times, and then we check that
this number of times is sufficient by replacing the {\tt goto} statement by
{\tt assert(FALSE);}.

\subsection{{\tt break} and {\tt continue}}

The {\tt break} and {\tt continue} statements are replaced by equivalent
{\tt goto} statements as described in the ANSI-C standard.

\subsection{\tt switch}

\cbmc{} provides limited support for {\tt switch} statements. The following
restrictions are enforced:
%
\begin{itemize}
\item \cbmc{} does not allow ''fall-through''. A construct such as
%
\begin{alltt}
  switch(i) \{
    case 1: j++;
    case 2: j++; break;
  \}
\end{alltt}
%
is not permitted.

\item \cbmc{} does not allow {\tt switch} targets within {\tt if}
or loop statements.
\end{itemize}

\subsection{Loops}

\label{loopsec}

In Bounded Model Checking, the transition system is unwound up to a finite
depth. In case of C programs, this means that {\tt for} and {\tt while} are
unwound up to a certain depth. In many cases, \cbmc{} is able to
automatically detect the maximum number of times a loop can be executed. This
includes {\tt while} loops and loops with modifications to the loop counter
inside the loop body, even when done indirectly using a pointer.

However, in case of loops that have no pre-set bound, e.g., loops iterating
on dynamic data structures, the user must specify a bound by means of the
{\tt --unwind} command line argument. \cbmc{} will then unwind the loops up
to that bound and check that the number is large enough by means of an {\it
unwinding assertion}.

\section{Non-Determinism}

\label{nondeterminism}

\cbmc{} allows to model user-input by means of non-deterministic choice
functions. The names of these functions have the prefix {\tt nondet\_}. The
value range generated is determined by the return type of the function. As
an example,
%
\begin{alltt}
  int nondet_int();
\end{alltt}
%
returns a nondeterministically chosen value of type {\tt int}. The
functions are built-in, i.e., the prototype is sufficient. \cbmc{} will
evaluate all traces arising from all possible choices.

\section{Assumptions and Assertions}

\cbmc{} checks assertions as defined by the ANSI-C standard: The {\tt
assert} statement takes a Boolean condition, and \cbmc{} checks that this
condition is {\textsf true} for all runs of the program. The logic for
assertions is the usual ANSI-C expression logic.

In addition to the {\tt assert} statement, \cbmc{} provides the {\tt assume}
statement. The {\tt assume} statement restricts the program traces that are
considered and allows assume-guarantee reasoning. As an assertion, an
assumption takes a Boolean expression. Intuitively, one can consider the
{\tt assume} statement to abort the program {\it successfully} if the
condition is false. If the condition is {\textsf true}, the execution
continues.

As an example, the following function first nondeterministically picks an
integer value. It then assumes that the integer is in a specific range and
returns the value.
%
\begin{alltt}
int one_to_ten() \{
  int value=nondet_int();
  assume(value>=1 && value<=10);
  return value;
\}
\end{alltt}

Note that the assume statement is not retro-active with respect to
assertions. E.g., 
%
\begin{alltt}
  assert(value<10);
  assume(value==0);
\end{alltt}
%
may fail, while
%
\begin{alltt}
  assume(value==0);
  assert(value<10);
\end{alltt}
%
passes.

When using the {\tt assume} statement, it must be ensured that there still
exists a program trace that satisfies the condition. Otherwise, any property
will pass vacuously. This should be checked by replacing the property by
{\textsf false}. If no counterexample is produced, the assumptions eliminate
all program paths.

\section{Arrays}

\cbmc{} allows arrays as defined by the ANSI-C standard. This includes
multi-dimensional arrays and dynamically-sized arrays.

\paragraph{Dynamic Arrays}

The ANSI-C standard allows arrays with non-constant size as long as the
array does not have static storage duration, i.e., is a non-static local
variable. Even though such a construct has a potentially huge state space,
\cbmc{} provides full support for arrays with non-constant size. The size of
the Boolean equation that is generated does not depend on the array size,
but rather on the number of read or write accesses to the array.

\paragraph{Properties Checked}

\cbmc{} checks both lower and upper bound of arrays, even for arrays with
dynamic size. As an example, consider the following fragment:
%
\begin{alltt}
{
  unsigned size=nondet_uint();
  char a[size];

  a[10]=0;
}
\end{alltt}

In this fragment, an array {\tt a} is defined, which has a
nondeterministically chosen size. The code then accesses the array element
with index 10. \cbmc{} produces a counterexample with an upper array bound
error on array {\tt a}. The trace shows a value for {\tt size} less then
10.

Furthermore, \cbmc{} checks that the size of arrays with dynamic size is
non-negative. As an example, consider the following fragment:
%
\begin{alltt}
{
  signed size=nondet_int();
  char a[size];
}
\end{alltt}

For this fragment, \cbmc{} produces a counterexample in which the size of
the array {\tt a} is negative.

\section{Structures}

\cbmc{} allows arbitrary structure types. The structures may be nested, and
may contain arrays.

The {\tt sizeof} operator applied to a structure type yields the sum of the
sizes of the components. However, the ANSI-C standard allows arbitrary
padding between components. In order to reflect this padding, the {\tt
sizeof} operator should return the sum of the sizes of the components
\emph{plus} a nondeterministically chosen non-negative value.

\paragraph{Recursive Structures}

Structures may be recursive by means of pointers to the same structure. As
an example, consider the following fragment:
%
\begin{alltt}
struct nodet \{
  struct nodet *n;
  int payload;
\};

int main() \{
  unsigned i;
  struct nodet *list=(void *)0;
  struct nodet *new_node;
  
  for(i=0; i<10; i++) \{
    new_node=malloc(sizeof(*new_node));
    new_node->n=list;
    list=new_node;
  \}
\}
\end{alltt}
%
The fragment builds a linked list with ten dynamically allocated elements.

\paragraph{Structures with Dynamic Array}

The last component of an ANSI-C structure may be an incomplete array (an
array without size). This incomplete array is used for dynamic allocation.
This is described in section \ref{dynamic_memorysec}.

\section{Unions}

\cbmc{} allows the use of unions to use the same storage for multiple data
types. Internally, \cbmc{} actually shares the literals used to represent
the variables values among the union members.

\paragraph{Properties Checked} \cbmc{} does not permit the use of unions for
type conversion, as this would result in architecture dependent behavior.
Specifically, if a member is read, the same member must have been used for
writing to the union the last time.

\section{Pointers}

\subsection{The Pointer Data Type}

Pointers are commonly used in ANSI-C programs. In particular, pointers are
required for call by reference and for dynamic data structures. \cbmc{}
provides extensive support for programs that use pointers according to rules
set by the ANSI-C standard, including pointer type casts and pointer
arithmetic.

The size of a pointer, e.g., {\tt sizeof(void *)} is by default 4 bytes.
This can be adjusted using a command line option.

\paragraph{Conversion of pointers from and to integers} The ANSI-C standard
does not provide any guarantees for the conversion of pointers into
integers. However, \cbmc{} ensures that the conversion of the same address
into an integer yields the same integer. The ANSI-C standard does not
guarantee that the conversion of a pointer into an integer and then back
yields a valid pointer. \cbmc{} does not allow this construct.

\subsection{Pointer Arithmetic}

\cbmc{} supports the ANSI-C pointer arithmetic operators. As an example,
consider the following fragment:
%
\begin{alltt}
int array[10], *p;

int main() \{
        array[1] = 1;
        p = &array[0];
        p++;

        assert(*p == 1);
\}
\end{alltt}

\subsection{The Relational Operators on Pointers}

The ANSI-C standard allows comparing to pointers using the relational
operators {\tt <=}, {\tt <}, {\tt >=}, {\tt <}.

\paragraph{Properties Checked} The standard restricts the use of these
operators to pointers that point to the same object. \cbmc{} enforces this
restriction by means of an automatically generated assertion.

\subsection{Pointer Type Casts}

\cbmc{} provides full support for pointer type casts as described by the
ANSI-C standard. As an example, it is a common practice to convert a pointer
to, e.g., an integer into a pointer to {\tt void} and then back:
%
\begin{alltt}
  int i;
  void *p;

  p=&i;
  . . .
  *((int *)p)=5;
\end{alltt}

Note that pointer type casts are frequently used for architecture specific
type conversions, e.g., to write an integer byte-wise into a file or to send
it over a socket:
%
\begin{alltt}
  int i;
  char *p;

  p=(char *)&i;

  for(j=0; j<4; j++) \{
    /* write *p */
    p++;
  \}
\end{alltt}
%
The result is architecture-dependent. In particular, it exposes the
endianess of the architecture. \cbmc{} does not allow these constructs.
It encourages to use architecture-independent constructs instead, e.g.,
using the shift operators.

\paragraph{Properties Checked}

\cbmc{} checks that the type of the object being accessed matches the type
of the dereferencing expression. For example, the following fragment uses a
{\tt void *} pointer to store the addresses of both {\tt char} and {\tt int}
type objects:
%
\begin{alltt}
int nondet_int();

void *p;
int i;
char c;

int main() \{
  int input1, input2, z;

  input1=nondet_int();
  input2=nondet_int();

  p=input1? (void *)&i : (void *)&c;

  if(input2)
    z=*(int *)p;
  else
    z=*(char *)p;
\}
\end{alltt}
%
\cbmc{} produces the following counterexample:
%
\begin{alltt}
Initial State
----------------------------------------------------
  c=0 (00000000)
  i=0 (00000000000000000000000000000000)
  p=NULL

State 1 file line 10 function main
----------------------------------------------------
  input1=0 (00000000000000000000000000000000)

State 2 file line 11 function main
----------------------------------------------------
  input2=1 (00000000000000000000000000000001)

State 3 line 13 function main
----------------------------------------------------
  p=&c

Failed assertion: dereference failure (wrong object type)
line 16 function main
\end{alltt}

Note that the ANSI-C standard allows the conversion of pointers to
structures to another pointer to a prefix of the same structure. As an
example, the following program performs a valid pointer conversion:
%
\begin{alltt}
typedef struct \{
  int i;
  char j;
\} s;

typedef struct \{
  int i;
\} prefix;

int main() \{
  s x;
  prefix *p;

  p=(prefix *)&x;

  p->i=1;
\}
\end{alltt}

\subsection{String Constants}

ANSI-C implements strings of characters as an array. Strings are then often
represented by means of a pointer pointing to the array. Array bounds
violations of string arrays are the leading cause of security holes in
Internet software such as servers or web browsers.

\cbmc{} provides full support for string constants, usable either in
initializers or as a constant. As an example, the following fragment
contains a string array {\tt s}, which is initialized using a string
constant. Then, a pointer {\tt p} is initialized with the address of {\tt
s}, and the second character of {\tt s} is modified indirectly by
dereferencing {\tt p}. The program then asserts this change to {\tt s}.
%
\begin{alltt}
char s[]="abc";

int main() \{
  char *p=s;

  /* write to p[1] */
  p[1]='y';
  
  assert(s[1]=='y'); 
\}
\end{alltt}

\paragraph{Properties Checked}

\cbmc{} performs bounds checking for string constants as well as for normal
arrays. In the following fragment, a pointer {\tt p} is pointing to a string
constant of length three. Then, an input {\tt i} is used as address of an
array index operation. \cbmc{} asserts that the input {\tt i} is not greater
than four (the string constant ends with an implicit zero character).
%
\begin{alltt}
char *p="abc";

void f(unsigned int i) \{
  char ch;

  /* results in bounds violation with i>4 */  
  ch=p[i];
\}
\end{alltt}

In addition to that, \cbmc{} checks that string constants are never written
into by means of pointers pointing to them.

\subsection{Pointers to Functions}

\cbmc{} allows pointers to functions, and calls through such a pointer. The
function pointed to may depend on nondeterministically chosen inputs. As
an example, the following fragment contains a table of three function
pointers. The program uses a function argument to index the table and then
calls the function. It then asserts that the right function was called.
%
\begin{alltt}
int global;

int f() \{ global=0; \}
int g() \{ global=1; \}
int h() \{ global=2; \}

typedef int (*fptr)();
fptr table[] = \{ f, g, h \};

void select(unsigned x) \{
  if(x<=2) \{
    table[x]();
    assert(global==x);
  \}
\}
\end{alltt}

\section{Dynamic Memory}

\label{dynamic_memorysec}

\cbmc{} allows programs that make use of dynamic memory allocation, e.g., for
dynamically sized arrays or data structures such as lists or graphs. As an
example, the following fragment allocates a variable number of integers
using {\tt malloc}, writes one value into the last array element, and then
deallocates the array:
%
\begin{alltt}
void f(unsigned int n) \{
  int *p;
  
  p=malloc(sizeof(int)*n);

  p[n-1]=0;

  free(p);
\}
\end{alltt}

\paragraph{Properties Checked}

Optionally, \cbmc{} checks array bounds of dynamically allocated arrays, and
it checks that a pointer pointing to a dynamic object is pointing to an
active object (i.e., that the object has not yet been freed and that it is
not a static object). Furthermore, \cbmc{} checks that an object is not
freed more than once.

In addition to that, \cbmc{} can check that all dynamically allocated memory
is deallocated before exiting the program, i.e., \cbmc{} can prove the
absence of ''memory leaks''.

As an example, the following fragment dynamically allocates memory, and
stores the address of that memory in a pointer {\tt p}. Depending on an
input {\tt i}, this pointer is redirected to a local variable {\tt y}.
The memory pointed to by {\tt p} is then deallocated using {\tt free}.
\cbmc{} detects that there is an illegal execution trace in case that the
input {\tt i} is {\textsf true}.
%
\begin{alltt}
void f(_Bool i) \{
  int *p;
  int y;

  p=malloc(sizeof(int)*10);

  if(i) p=&y;

  /* error if p points to y */  
  free(p);
\}
\end{alltt}
