From f8de3b4b9b3acbda2b82522816f1c265954ef5be Mon Sep 17 00:00:00 2001 From: shuvendu Date: Fri, 19 Sep 2014 18:05:18 -0700 Subject: more tests for houdini /inlineDepth --- Test/houdini/deterministic.bpl | 27 + Test/houdini/deterministic.bpl.expect | 3 + Test/houdini/mergedProgSingle_dac.bpl | 7616 ++++++++++++++++++++++ Test/houdini/mergedProgSingle_dac.bpl.expect | 190 + Test/houdini/mergedProgSingle_res_ex1.bpl | 621 ++ Test/houdini/mergedProgSingle_res_ex1.bpl.expect | 8 + Test/houdini/mergedProgSingle_res_ex2.bpl | 621 ++ Test/houdini/mergedProgSingle_res_ex2.bpl.expect | 8 + 8 files changed, 9094 insertions(+) create mode 100644 Test/houdini/deterministic.bpl create mode 100644 Test/houdini/deterministic.bpl.expect create mode 100644 Test/houdini/mergedProgSingle_dac.bpl create mode 100644 Test/houdini/mergedProgSingle_dac.bpl.expect create mode 100644 Test/houdini/mergedProgSingle_res_ex1.bpl create mode 100644 Test/houdini/mergedProgSingle_res_ex1.bpl.expect create mode 100644 Test/houdini/mergedProgSingle_res_ex2.bpl create mode 100644 Test/houdini/mergedProgSingle_res_ex2.bpl.expect (limited to 'Test/houdini') diff --git a/Test/houdini/deterministic.bpl b/Test/houdini/deterministic.bpl new file mode 100644 index 00000000..8a6c0cd6 --- /dev/null +++ b/Test/houdini/deterministic.bpl @@ -0,0 +1,27 @@ +// RUN: %boogie /nologo /contractInfer /inlineDepth:1 /printAssignment /noinfer "%s" > "%t" +// RUN: %diff "%s.expect" "%t" + + +function f(a:int):int; + +procedure {:inline 1} Foo(x:int) returns (r:int) +free ensures r == f(x); +{ + if (x >0 ) { + call r := Foo(x); + r := r + 1; + havoc r; + } else { + r := 0; + } + return; +} + +procedure Check(x1:int, x2:int) +{ + var r1: int, r2:int; + + call r1 := Foo(x2); //inlined + call r2 := Foo(x2); //inlined + assert r1 == r2; +} diff --git a/Test/houdini/deterministic.bpl.expect b/Test/houdini/deterministic.bpl.expect new file mode 100644 index 00000000..22b480b4 --- /dev/null +++ b/Test/houdini/deterministic.bpl.expect @@ -0,0 +1,3 @@ +Assignment computed by Houdini: + +Boogie program verifier finished with 1 verified, 0 errors diff --git a/Test/houdini/mergedProgSingle_dac.bpl b/Test/houdini/mergedProgSingle_dac.bpl new file mode 100644 index 00000000..26ff38d7 --- /dev/null +++ b/Test/houdini/mergedProgSingle_dac.bpl @@ -0,0 +1,7616 @@ +// RUN: %boogie /nologo /contractInfer /inlineDepth:1 /printAssignment /noinfer "%s" > "%t" +// RUN: %diff "%s.expect" "%t" + +function _v2.ite(b: bool, x: int, y: int) : int; + +var _v2.OK: bool; + +var {:extern} _v2.Mem: [name][int]int; + +var {:extern} _v2.alloc: int; + +var {:extern} _v2.Mem_T.A1CHAR: [int]int; + +var {:extern} _v2.Mem_T.A5UCHAR: [int]int; + +var {:extern} _v2.Mem_T.A6UCHAR: [int]int; + +var {:extern} _v2.Mem_T.CHAR: [int]int; + +var {:extern} _v2.Mem_T.INT4: [int]int; + +var {:extern} _v2.Mem_T.PCHAR: [int]int; + +var {:extern} _v2.Mem_T.PUCHAR: [int]int; + +var {:extern} _v2.Mem_T.PVOID: [int]int; + +var {:extern} _v2.Mem_T.Pieee80211_scan_entry: [int]int; + +var {:extern} _v2.Mem_T.UCHAR: [int]int; + +var {:extern} _v2.Mem_T.VOID: [int]int; + +var {:extern} _v2.Mem_T.ieee80211_scan_entry: [int]int; + +var {:extern} _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + +var {:extern} _v2.detChoiceCnt: int; + +var {:extern} _v2.Res_KERNEL_SOURCE: [int]int; + +var {:extern} _v2.Res_PROBED: [int]int; + +const {:extern} unique _v2.T.se_rsn_ie_ieee80211_scan_entry: name; + +const {:extern} unique _v2.T.A1CHAR: name; + +const {:extern} unique _v2.T.A5UCHAR: name; + +const {:extern} unique _v2.T.A6UCHAR: name; + +const {:extern} unique _v2.T.CHAR: name; + +const {:extern} unique _v2.T.INT4: name; + +const {:extern} unique _v2.T.PA1CHAR: name; + +const {:extern} unique _v2.T.PA5UCHAR: name; + +const {:extern} unique _v2.T.PA6UCHAR: name; + +const {:extern} unique _v2.T.PCHAR: name; + +const {:extern} unique _v2.T.PINT4: name; + +const {:extern} unique _v2.T.PPCHAR: name; + +const {:extern} unique _v2.T.PPUCHAR: name; + +const {:extern} unique _v2.T.PPVOID: name; + +const {:extern} unique _v2.T.PPieee80211_scan_entry: name; + +const {:extern} unique _v2.T.PUCHAR: name; + +const {:extern} unique _v2.T.PUINT4: name; + +const {:extern} unique _v2.T.PVOID: name; + +const {:extern} unique _v2.T.Pieee80211_scan_entry: name; + +const {:extern} unique _v2.T.UCHAR: name; + +const {:extern} unique _v2.T.UINT4: name; + +const {:extern} unique _v2.T.VOID: name; + +const {:extern} unique _v2.T.ieee80211_scan_entry: name; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 16} unique _v2.__ctobpl_const_8: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 13} unique _v2.__ctobpl_const_2: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 15} unique _v2.__ctobpl_const_3: int; + +const {:extern} {:model_const "buf"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 15} unique _v2.__ctobpl_const_4: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 16} unique _v2.__ctobpl_const_5: int; + +const {:extern} {:model_const "leader"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 16} unique _v2.__ctobpl_const_6: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 16} unique _v2.__ctobpl_const_7: int; + +const {:extern} {:model_const "leader"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 16} unique _v2.__ctobpl_const_9: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 16} unique _v2.__ctobpl_const_10: int; + +const {:extern} {:model_const "encode_ie.arg.4"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 53} unique _v2.__ctobpl_const_44: int; + +const {:extern} {:model_const "(se.se_rsn_ie)[0]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 66} unique _v2.__ctobpl_const_50: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 51} unique _v2.__ctobpl_const_34: int; + +const {:extern} {:model_const "se.se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 67} unique _v2.__ctobpl_const_51: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 53} unique _v2.__ctobpl_const_45: int; + +const {:extern} {:model_const "(se.se_rsn_ie)[1]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 67} unique _v2.__ctobpl_const_52: int; + +const {:extern} {:model_const "(se->se_rsn_ie)[0]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 52} unique _v2.__ctobpl_const_37: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 53} unique _v2.__ctobpl_const_42: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 54} unique _v2.__ctobpl_const_39: int; + +const {:extern} {:model_const "encode_ie.arg.4"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 53} unique _v2.__ctobpl_const_47: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 54} unique _v2.__ctobpl_const_40: int; + +const {:extern} {:model_const "encode_ie.arg.4"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 54} unique _v2.__ctobpl_const_38: int; + +const {:extern} {:model_const "se.se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 66} unique _v2.__ctobpl_const_49: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 52} unique _v2.__ctobpl_const_35: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 53} unique _v2.__ctobpl_const_43: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 53} unique _v2.__ctobpl_const_46: int; + +const {:extern} {:model_const "se.se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 65} unique _v2.__ctobpl_const_48: int; + +const {:extern} {:model_const "(se->se_rsn_ie)[1]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 54} unique _v2.__ctobpl_const_41: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 52} unique _v2.__ctobpl_const_36: int; + +const {:extern} {:model_const "bufsize"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 13} unique _v2.__ctobpl_const_1: int; + +const {:extern} {:model_const "buf"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 39} unique _v2.__ctobpl_const_31: int; + +const {:extern} {:model_const "ielen"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 20} unique _v2.__ctobpl_const_17: int; + +const {:extern} {:model_const "*(p + 1)"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 32} unique _v2.__ctobpl_const_24: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 39} unique _v2.__ctobpl_const_18: int; + +const {:extern} {:model_const "bufsize"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 34} unique _v2.__ctobpl_const_26: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 18} unique _v2.__ctobpl_const_14: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 20} unique _v2.__ctobpl_const_27: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 51} unique _v2.__ctobpl_const_33: int; + +const {:extern} {:model_const "result.question.3"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 39} unique _v2.__ctobpl_const_28: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 20} unique _v2.__ctobpl_const_15: int; + +const {:extern} {:model_const "bufsize"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 17} unique _v2.__ctobpl_const_11: int; + +const {:extern} {:model_const "result.question.3"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 39} unique _v2.__ctobpl_const_29: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 17} unique _v2.__ctobpl_const_12: int; + +const {:extern} {:model_const "result.question.3"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 39} unique _v2.__ctobpl_const_32: int; + +const {:extern} {:model_const "ielen"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 39} unique _v2.__ctobpl_const_19: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 30} unique _v2.__ctobpl_const_21: int; + +const {:extern} {:model_const "*p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 30} unique _v2.__ctobpl_const_22: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 32} unique _v2.__ctobpl_const_23: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 20} unique _v2.__ctobpl_const_16: int; + +const {:extern} {:model_const "bufsize"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 20} unique _v2.__ctobpl_const_20: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 33} unique _v2.__ctobpl_const_25: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 18} unique _v2.__ctobpl_const_13: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceLine 39} unique _v2.__ctobpl_const_30: int; + +function {:extern} _v2.OneByteToInt(arg_0: byte) : int; + +function {:extern} _v2.TwoBytesToInt(arg_0: byte, arg_1: byte) : int; + +function {:extern} _v2.FourBytesToInt(arg_0: byte, arg_1: byte, arg_2: byte, arg_3: byte) : int; + +function {:extern} _v2.Field(arg_0: int) : name; + +function {:extern} _v2.Base(arg_0: int) : int; + +function {:extern} _v2.Match(a: int, t: name) : bool; + +function {:extern} _v2.MatchBase(b: int, a: int, t: name) : bool; + +function {:extern} _v2.HasType(v: int, t: name) : bool; + +function {:extern} _v2.T.Ptr(t: name) : name; + +function {:extern} _v2.se_rsn_ie_ieee80211_scan_entry(arg_0: int) : int; + +function {:extern} _v2.se_rsn_ie_ieee80211_scan_entryInv(arg_0: int) : int; + +function {:extern} _v2._S_se_rsn_ie_ieee80211_scan_entry(arg_0: [int]bool) : [int]bool; + +function {:extern} _v2._S_se_rsn_ie_ieee80211_scan_entryInv(arg_0: [int]bool) : [int]bool; + +function {:extern} _v2.INT_AND(a: int, b: int) : int; + +function {:extern} _v2.INT_OR(a: int, b: int) : int; + +function {:extern} _v2.INT_XOR(a: int, b: int) : int; + +function {:extern} _v2.INT_NOT(a: int) : int; + +function {:extern} _v2.POW2(a: int) : bool; + +function {:extern} _v2.INT_MINUS_LEFT_PTR(a: int, a_size: int, b: int) : int; + +function {:extern} _v2.INT_PLUS(a: int, a_size: int, b: int) : int; + +function {:extern} _v2.INT_MULT(a: int, b: int) : int; + +function {:extern} _v2.INT_DIV(a: int, b: int) : int; + +function {:extern} _v2.INT_BINARY_BOTH_INT(a: int, b: int) : int; + +function {:extern} _v2.BV32_EQ(x: bv32, y: bv32) : bool; + +function {:extern} _v2.BV32_NEQ(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvadd"} _v2.BV32_ADD(x: bv32, y: bv32) : bv32; + +function {:extern} {:bvbuiltin "bvsub"} _v2.BV32_SUB(x: bv32, y: bv32) : bv32; + +function {:extern} {:bvbuiltin "bvmul"} _v2.BV32_MULT(x: bv32, y: bv32) : bv32; + +function {:extern} {:bvbuiltin "bvudiv"} _v2.BV32_DIV(x: bv32, y: bv32) : bv32; + +function {:extern} {:bvbuiltin "bvult"} _v2.BV32_ULT(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvslt"} _v2.BV32_LT(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvule"} _v2.BV32_ULEQ(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvsle"} _v2.BV32_LEQ(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvugt"} _v2.BV32_UGT(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvsgt"} _v2.BV32_GT(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvuge"} _v2.BV32_UGEQ(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvsge"} _v2.BV32_GEQ(x: bv32, y: bv32) : bool; + +function {:extern} {:bvbuiltin "bvand"} _v2.BV32_AND(a: bv32, b: bv32) : bv32; + +function {:extern} {:bvbuiltin "bvor"} _v2.BV32_OR(a: bv32, b: bv32) : bv32; + +function {:extern} {:bvbuiltin "bvxor"} _v2.BV32_XOR(a: bv32, b: bv32) : bv32; + +function {:extern} {:bvbuiltin "bvnot"} _v2.BV32_NOT(a: bv32) : bv32; + +function {:extern} _v2.BV32_MINUS_BOTH_PTR_OR_BOTH_INT(a: bv32, b: bv32, size: bv32) : bv32; + +function {:extern} _v2.BV32_MINUS_LEFT_PTR(a: bv32, a_size: bv32, b: bv32) : bv32; + +function {:extern} _v2.BV32_PLUS(a: bv32, a_size: bv32, b: bv32) : bv32; + +function {:extern} _v2.BV32_BINARY_BOTH_INT(a: bv32, b: bv32) : bv32; + +function {:extern} _v2.bv32ToInt(arg_0: bv32) : int; + +function {:extern} _v2.intToBv32(arg_0: int) : bv32; + +function {:extern} _v2.choose(a: bool, b: int, c: int) : int; + +function {:extern} _v2.LIFT(a: bool) : int; + +function {:extern} _v2.PTR_NOT(a: int) : int; + +function {:extern} _v2.NULL_CHECK(a: int) : int; + +function {:extern} _v2.NewAlloc(x: int, y: int) : int; + +function {:extern} _v2.DetChoiceFunc(a: int) : int; + +function {:extern} _v2.Res_VALID_REGION(arg_0: int) : int; + +function {:extern} _v2.Equal(arg_0: [int]bool, arg_1: [int]bool) : bool; + +function {:extern} _v2.Subset(arg_0: [int]bool, arg_1: [int]bool) : bool; + +function {:extern} _v2.Disjoint(arg_0: [int]bool, arg_1: [int]bool) : bool; + +function {:extern} _v2.Empty() : [int]bool; + +function {:extern} _v2.SetTrue() : [int]bool; + +function {:extern} _v2.Singleton(arg_0: int) : [int]bool; + +function {:extern} _v2.Reachable(arg_0: [int,int]bool, arg_1: int) : [int]bool; + +function {:extern} _v2.Union(arg_0: [int]bool, arg_1: [int]bool) : [int]bool; + +function {:extern} _v2.Intersection(arg_0: [int]bool, arg_1: [int]bool) : [int]bool; + +function {:extern} _v2.Difference(arg_0: [int]bool, arg_1: [int]bool) : [int]bool; + +function {:extern} _v2.Dereference(arg_0: [int]bool, arg_1: [int]int) : [int]bool; + +function {:extern} _v2.Inverse(f: [int]int, x: int) : [int]bool; + +function {:extern} _v2.AtLeast(arg_0: int, arg_1: int) : [int]bool; + +function {:extern} _v2.Rep(arg_0: int, arg_1: int) : int; + +function {:extern} _v2.Array(arg_0: int, arg_1: int, arg_2: int) : [int]bool; + +function {:extern} _v2.Unified(arg_0: [name][int]int) : [int]int; + +function {:extern} _v2.value_is(c: int, e: int) : bool; + + +function {:inline true} _v2.se_rsn_ie_ieee80211_scan_entry(x : int) : int +{ +_v2.INT_ADD(x, 0) +} + +function {:inline true} _v2.INT_EQ(x : int, y : int): bool +{ +x == y +} + +function {:inline true} _v2.INT_NEQ(x : int, y: int): bool +{ +x != y +} + +function {:inline true} _v2.INT_ADD(x : int, y : int): int +{ +x + y +} + +function {:inline true} _v2.INT_SUB(x : int, y : int): int +{ + x - y +} + +function {:inline true} _v2.INT_LT(x : int, y : int): bool +{ +x < y +} + +function {:inline true} _v2.INT_ULT(x : int, y : int): bool +{ +x < y +} + +function {:inline true} _v2.INT_LEQ(x : int, y : int): bool +{ +x <= y +} + +function {:inline true} _v2.INT_ULEQ(x : int, y : int): bool +{ +x <= y +} + +function {:inline true} _v2.INT_GT(x : int, y : int): bool +{ +x > y +} + +function {:inline true} _v2.INT_UGT(x : int, y : int): bool +{ +x > y +} + +function {:inline true} _v2.INT_GEQ(x : int, y : int): bool +{ +x >= y +} + +function {:inline true} _v2.INT_UGEQ(x : int, y : int): bool +{ +x >= y +} + + + +procedure _v2.havoc_assert(i: int); + /* free */ requires i != 0; + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.havoc_assume(i: int); + /* free */ ensures i != 0; + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.__HAVOC_free(a: int); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.__HAVOC_malloc(obj_size: int) returns (new: int); + /* free */ requires _v2.INT_GEQ(obj_size, 0); + modifies _v2.alloc; + /* free */ ensures new == old(_v2.alloc); + /* free */ ensures _v2.INT_GT(_v2.alloc, _v2.INT_ADD(new, obj_size)); + /* free */ ensures _v2.Base(new) == new; + /* free */ ensures _v2.INT_GEQ(new, 0); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.__HAVOC_det_malloc(obj_size: int) returns (new: int); + /* free */ requires _v2.INT_GEQ(obj_size, 0); + modifies _v2.alloc; + /* free */ ensures new == old(_v2.alloc); + /* free */ ensures _v2.INT_GT(_v2.alloc, _v2.INT_ADD(new, obj_size)); + /* free */ ensures _v2.Base(new) == new; + /* free */ ensures _v2.alloc == _v2.NewAlloc(old(_v2.alloc), obj_size); + /* free */ ensures _v2.INT_GEQ(new, 0); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + + +procedure _v2.nondet_choice() returns (x: int); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.det_choice() returns (x: int); + modifies _v2.detChoiceCnt; + /* free */ ensures _v2.detChoiceCnt == _v2.INT_ADD(old(_v2.detChoiceCnt), 1); + /* free */ ensures x == _v2.DetChoiceFunc(old(_v2.detChoiceCnt)); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2._strdup(str: int) returns (new: int); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2._xstrcasecmp(a0: int, a1: int) returns (ret: int); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2._xstrcmp(a0: int, a1: int) returns (ret: int); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.memcpy(a0: int, a1: int, a2: int) returns (ret: int); + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.encode_ie(buf_.1: int, + bufsize_.1: int, + ie_.1: int, + ielen_.1: int, + leader_.1: int, + leader_len_.1: int) + returns (result.encode_ie$1: int); + modifies _v2.OK, _v2.Mem_T.UCHAR; + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.giwscan_cb(se_.1: int) returns (result.giwscan_cb$1: int); + modifies _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.main() returns (result.main$1: int); + modifies _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +procedure _v2.encode_ie_loop_label_14_head(in_bufsize: int, in_i: int, in_ielen: int, in_p: int, in_tempBoogie0: int) + returns (out_bufsize: int, out_i: int, out_p: int, out_tempBoogie0: int); + modifies _v2.Mem_T.UCHAR, _v2.OK; + /* free */ ensures _v2.OK ==> old(_v2.OK); + + + +implementation _v2.encode_ie(buf_.1: int, + bufsize_.1: int, + ie_.1: int, + ielen_.1: int, + leader_.1: int, + leader_len_.1: int) + returns (result.encode_ie$1: int) +{ + var {:extern} havoc_stringTemp: int; + var {:extern} condVal: int; + var {:extern} buf: int; + var {:extern} bufsize: int; + var {:extern} i: int; + var {:extern} ie: int; + var {:extern} ielen: int; + var {:extern} leader: int; + var {:extern} leader_len: int; + var {:extern} p: int; + var {:extern} result.memcpy$2: int; + var {:extern} $result.question.3.$$static$: int; + var {:extern} tempBoogie0: int; + var {:extern} tempBoogie1: int; + var {:extern} tempBoogie2: int; + var {:extern} tempBoogie3: int; + var {:extern} tempBoogie4: int; + var {:extern} tempBoogie5: int; + var {:extern} tempBoogie6: int; + var {:extern} tempBoogie7: int; + var {:extern} tempBoogie8: int; + var {:extern} tempBoogie9: int; + var {:extern} tempBoogie10: int; + var {:extern} tempBoogie11: int; + var {:extern} tempBoogie12: int; + var {:extern} tempBoogie13: int; + var {:extern} tempBoogie14: int; + var {:extern} tempBoogie15: int; + var {:extern} tempBoogie16: int; + var {:extern} tempBoogie17: int; + var {:extern} tempBoogie18: int; + var {:extern} tempBoogie19: int; + var {:extern} __havoc_dummy_return: int; + + anon0#2: + havoc_stringTemp := 0; + goto start#2; + + start#2: + assume _v2.INT_LT(buf_.1, _v2.alloc); + assume _v2.INT_LT(ie_.1, _v2.alloc); + assume _v2.INT_LT(leader_.1, _v2.alloc); + buf := 0; + assume _v2.INT_GEQ(buf_.1, 0); + bufsize := 0; + i := 0; + ie := 0; + assume _v2.INT_GEQ(ie_.1, 0); + ielen := 0; + leader := 0; + assume _v2.INT_GEQ(leader_.1, 0); + leader_len := 0; + p := 0; + result.encode_ie$1 := 0; + result.memcpy$2 := 0; + $result.question.3.$$static$ := 0; + buf := buf_.1; + bufsize := bufsize_.1; + ie := ie_.1; + ielen := ielen_.1; + leader := leader_.1; + leader_len := leader_len_.1; + goto label_3#2; + + label_3#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 9} true; + goto label_4#2; + + label_4#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 10} true; + goto label_5#2; + + label_5#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 13} true; + goto label_5_true#2, label_5_false#2; + + label_5_false#2: + assume !_v2.INT_LT(bufsize, leader_len); + assume _v2.value_is(_v2.__ctobpl_const_1, bufsize); + assume _v2.value_is(_v2.__ctobpl_const_2, leader_len); + goto label_6#2; + + label_6#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 15} true; + p := buf; + assume _v2.value_is(_v2.__ctobpl_const_3, p); + assume _v2.value_is(_v2.__ctobpl_const_4, buf); + goto label_8#2; + + label_8#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 16} true; + call result.memcpy$2 := _v2.memcpy(p, leader, leader_len); + assume _v2.value_is(_v2.__ctobpl_const_5, p); + assume _v2.value_is(_v2.__ctobpl_const_6, leader); + assume _v2.value_is(_v2.__ctobpl_const_7, leader_len); + assume _v2.value_is(_v2.__ctobpl_const_8, p); + assume _v2.value_is(_v2.__ctobpl_const_9, leader); + assume _v2.value_is(_v2.__ctobpl_const_10, leader_len); + goto label_11#2; + + label_11#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 17} true; + havoc tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(bufsize, leader_len, 1, tempBoogie0); + bufsize := tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_11, bufsize); + assume _v2.value_is(_v2.__ctobpl_const_12, leader_len); + goto label_12#2; + + label_12#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 18} true; + tempBoogie0 := _v2.INT_PLUS(p, 1, leader_len); + p := tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_13, p); + assume _v2.value_is(_v2.__ctobpl_const_14, leader_len); + goto label_13#2; + + label_13#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + i := 0; + assume _v2.value_is(_v2.__ctobpl_const_15, i); + goto label_14#2; + + label_14#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + goto label_14_head#2; + + label_14_head#2: + call bufsize, i, p, tempBoogie0 := _v2.encode_ie_loop_label_14_head(bufsize, i, ielen, p, tempBoogie0); + goto label_14_head_last#2; + + label_14_head_last#2: + goto label_14_true#2, label_14_false#2; + + label_14_false#2: + assume !_v2.INT_LT(i, ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, i); + assume _v2.value_is(_v2.__ctobpl_const_17, ielen); + goto label_15#2; + + label_14_true#2: + assume _v2.INT_LT(i, ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, i); + assume _v2.value_is(_v2.__ctobpl_const_17, ielen); + goto label_16#2; + + label_16#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + goto label_16_true#2, label_16_false#2; + + label_16_false#2: + assume !_v2.INT_LT(2, bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, bufsize); + goto label_15#2; + + label_15#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + goto label_15_true#2, label_15_false#2; + + label_15_false#2: + assume !_v2.INT_EQ(i, ielen); + assume _v2.value_is(_v2.__ctobpl_const_18, i); + assume _v2.value_is(_v2.__ctobpl_const_19, ielen); + goto label_22#2; + + label_22#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + $result.question.3.$$static$ := 0; + assume _v2.value_is(_v2.__ctobpl_const_28, $result.question.3.$$static$); + goto label_24#2; + + label_15_true#2: + assume _v2.INT_EQ(i, ielen); + assume _v2.value_is(_v2.__ctobpl_const_18, i); + assume _v2.value_is(_v2.__ctobpl_const_19, ielen); + goto label_23#2; + + label_23#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + havoc $result.question.3.$$static$; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(p, buf, 1, $result.question.3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_29, $result.question.3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_30, p); + assume _v2.value_is(_v2.__ctobpl_const_31, buf); + goto label_24#2; + + label_24#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + result.encode_ie$1 := $result.question.3.$$static$; + assume _v2.value_is(_v2.__ctobpl_const_32, $result.question.3.$$static$); + goto label_1#2; + + label_16_true#2: + assume _v2.INT_LT(2, bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, bufsize); + goto label_17#2; + + label_17#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(p, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(p) == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[p := 120]; + assume _v2.value_is(_v2.__ctobpl_const_21, p); + assume _v2.value_is(_v2.__ctobpl_const_22, _v2.Mem_T.UCHAR[p]); + goto label_18#2; + + label_18#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(p, 1, 1), 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.INT_PLUS(p, 1, 1)) == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(p, 1, 1) := 120]; + assume _v2.value_is(_v2.__ctobpl_const_23, p); + assume _v2.value_is(_v2.__ctobpl_const_24, _v2.Mem_T.UCHAR[_v2.INT_PLUS(p, 1, 1)]); + goto label_19#2; + + label_19#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 33} true; + tempBoogie0 := _v2.INT_PLUS(p, 1, 2); + p := tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_25, p); + goto label_20#2; + + label_20#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 34} true; + havoc tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(bufsize, 2, 1, tempBoogie0); + bufsize := tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_26, bufsize); + goto label_21#2; + + label_21#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + assume _v2.value_is(_v2.__ctobpl_const_27, i); + i := _v2.INT_PLUS(i, 1, 1); + goto label_21_dummy#2; + + label_21_dummy#2: + assume false; + return; + + label_5_true#2: + assume _v2.INT_LT(bufsize, leader_len); + assume _v2.value_is(_v2.__ctobpl_const_1, bufsize); + assume _v2.value_is(_v2.__ctobpl_const_2, leader_len); + goto label_7#2; + + label_7#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 14} true; + result.encode_ie$1 := 0; + goto label_1#2; + + label_1#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 40} true; + return; +} + + + +implementation _v2.giwscan_cb(se_.1: int) returns (result.giwscan_cb$1: int) +{ + var {:extern} havoc_stringTemp: int; + var {:extern} condVal: int; + var {:extern} buf: int; + var {:extern} $encode_ie.arg.4$3.$$static$: int; + var {:extern} result.encode_ie$2: int; + var {:extern} rsn_leader: int; + var {:extern} se: int; + var {:extern} tempBoogie0: int; + var {:extern} tempBoogie1: int; + var {:extern} tempBoogie2: int; + var {:extern} tempBoogie3: int; + var {:extern} tempBoogie4: int; + var {:extern} tempBoogie5: int; + var {:extern} tempBoogie6: int; + var {:extern} tempBoogie7: int; + var {:extern} tempBoogie8: int; + var {:extern} tempBoogie9: int; + var {:extern} tempBoogie10: int; + var {:extern} tempBoogie11: int; + var {:extern} tempBoogie12: int; + var {:extern} tempBoogie13: int; + var {:extern} tempBoogie14: int; + var {:extern} tempBoogie15: int; + var {:extern} tempBoogie16: int; + var {:extern} tempBoogie17: int; + var {:extern} tempBoogie18: int; + var {:extern} tempBoogie19: int; + var {:extern} __havoc_dummy_return: int; + + anon0#2: + havoc_stringTemp := 0; + goto start#2; + + start#2: + assume _v2.INT_LT(se_.1, _v2.alloc); + call buf := _v2.__HAVOC_det_malloc(6); + $encode_ie.arg.4$3.$$static$ := 0; + result.encode_ie$2 := 0; + result.giwscan_cb$1 := 0; + call rsn_leader := _v2.__HAVOC_det_malloc(1); + se := 0; + assume _v2.INT_GEQ(se_.1, 0); + se := se_.1; + goto label_3#2; + + label_3#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 46} true; + goto label_4#2; + + label_4#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 47} true; + goto label_5#2; + + label_5#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 51} true; + assume _v2.INT_GEQ(se, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + goto label_5_true#2, label_5_false#2; + + label_5_false#2: + assume _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)] + == 0; + assume _v2.value_is(_v2.__ctobpl_const_33, se); + assume _v2.value_is(_v2.__ctobpl_const_34, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + goto label_6#2; + + label_5_true#2: + assume _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)] + != 0; + assume _v2.value_is(_v2.__ctobpl_const_33, se); + assume _v2.value_is(_v2.__ctobpl_const_34, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + goto label_7#2; + + label_7#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 52} true; + assume _v2.INT_GEQ(se, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)) + == 1; + assert true; + goto label_7_true#2, label_7_false#2; + + label_7_false#2: + assume !_v2.INT_EQ(_v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)], + 200); + assume _v2.value_is(_v2.__ctobpl_const_35, se); + assume _v2.value_is(_v2.__ctobpl_const_36, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v2.__ctobpl_const_37, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)]); + goto label_6#2; + + label_7_true#2: + assume _v2.INT_EQ(_v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)], + 200); + assume _v2.value_is(_v2.__ctobpl_const_35, se); + assume _v2.value_is(_v2.__ctobpl_const_36, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v2.__ctobpl_const_37, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)]); + goto label_8#2; + + label_8#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 54} true; + assume _v2.INT_GEQ(se, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)) + == 1; + assert true; + $encode_ie.arg.4$3.$$static$ := _v2.INT_PLUS(_v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)], + 1, + 2); + assume _v2.value_is(_v2.__ctobpl_const_38, $encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_39, se); + assume _v2.value_is(_v2.__ctobpl_const_40, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v2.__ctobpl_const_41, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)]); + goto label_9#2; + + label_9#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 53} true; + assume _v2.INT_GEQ(se, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(se, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + call result.encode_ie$2 := _v2.encode_ie(buf, 6, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], $encode_ie.arg.4$3.$$static$, rsn_leader, 1); + assume _v2.value_is(_v2.__ctobpl_const_42, se); + assume _v2.value_is(_v2.__ctobpl_const_43, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v2.__ctobpl_const_44, $encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_45, se); + assume _v2.value_is(_v2.__ctobpl_const_46, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v2.__ctobpl_const_47, $encode_ie.arg.4$3.$$static$); + goto label_6#2; + + label_6#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 58} true; + result.giwscan_cb$1 := 0; + goto label_1#2; + + label_1#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 59} true; + call _v2.__HAVOC_free(buf); + call _v2.__HAVOC_free(rsn_leader); + return; +} + + + +implementation _v2.main() returns (result.main$1: int) +{ + var {:extern} havoc_stringTemp: int; + var {:extern} condVal: int; + var {:extern} ie: int; + var {:extern} result.giwscan_cb$2: int; + var {:extern} se: int; + var {:extern} tempBoogie0: int; + var {:extern} tempBoogie1: int; + var {:extern} tempBoogie2: int; + var {:extern} tempBoogie3: int; + var {:extern} tempBoogie4: int; + var {:extern} tempBoogie5: int; + var {:extern} tempBoogie6: int; + var {:extern} tempBoogie7: int; + var {:extern} tempBoogie8: int; + var {:extern} tempBoogie9: int; + var {:extern} tempBoogie10: int; + var {:extern} tempBoogie11: int; + var {:extern} tempBoogie12: int; + var {:extern} tempBoogie13: int; + var {:extern} tempBoogie14: int; + var {:extern} tempBoogie15: int; + var {:extern} tempBoogie16: int; + var {:extern} tempBoogie17: int; + var {:extern} tempBoogie18: int; + var {:extern} tempBoogie19: int; + var {:extern} __havoc_dummy_return: int; + + anon0#2: + havoc_stringTemp := 0; + goto start#2; + + start#2: + call ie := _v2.__HAVOC_det_malloc(5); + result.giwscan_cb$2 := 0; + result.main$1 := 0; + call se := _v2.__HAVOC_det_malloc(4); + goto label_3#2; + + label_3#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 63} true; + goto label_4#2; + + label_4#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 64} true; + goto label_5#2; + + label_5#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 65} true; + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry := _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se) := ie]; + assume _v2.value_is(_v2.__ctobpl_const_48, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + goto label_6#2; + + label_6#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 66} true; + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)) + == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0) := 200]; + assume _v2.value_is(_v2.__ctobpl_const_49, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v2.__ctobpl_const_50, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)]); + goto label_7#2; + + label_7#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 67} true; + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)) + == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1) := 3]; + assume _v2.value_is(_v2.__ctobpl_const_51, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v2.__ctobpl_const_52, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)]); + goto label_8#2; + + label_8#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 69} true; + assume _v2.INT_GT(se, 0); + assume _v2.INT_GT(se, 0); + call result.giwscan_cb$2 := _v2.giwscan_cb(se); + goto label_11#2; + + label_11#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 71} true; + result.main$1 := 0; + goto label_1#2; + + label_1#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 72} true; + call _v2.__HAVOC_free(ie); + call _v2.__HAVOC_free(se); + return; +} + + + +implementation _v2.encode_ie_loop_label_14_head(in_bufsize: int, in_i: int, in_ielen: int, in_p: int, in_tempBoogie0: int) + returns (out_bufsize: int, out_i: int, out_p: int, out_tempBoogie0: int) +{ + + entry#2: + out_bufsize, out_i, out_p, out_tempBoogie0 := in_bufsize, in_i, in_p, in_tempBoogie0; + goto label_14_head#2; + + label_14_head#2: + goto label_14_true#2, label_14_false#2; + + label_14_false#2: + assume !_v2.INT_LT(out_i, in_ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, out_i); + assume _v2.value_is(_v2.__ctobpl_const_17, in_ielen); + out_bufsize, out_i, out_p, out_tempBoogie0 := in_bufsize, in_i, in_p, in_tempBoogie0; + _v2.Mem_T.UCHAR := old(_v2.Mem_T.UCHAR); + return; + + label_14_true#2: + assume _v2.INT_LT(out_i, in_ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, out_i); + assume _v2.value_is(_v2.__ctobpl_const_17, in_ielen); + goto label_16#2; + + label_16#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + goto label_16_true#2, label_16_false#2; + + label_16_false#2: + assume !_v2.INT_LT(2, out_bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, out_bufsize); + out_bufsize, out_i, out_p, out_tempBoogie0 := in_bufsize, in_i, in_p, in_tempBoogie0; + _v2.Mem_T.UCHAR := old(_v2.Mem_T.UCHAR); + return; + + label_16_true#2: + assume _v2.INT_LT(2, out_bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, out_bufsize); + goto label_17#2; + + label_17#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(out_p, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(out_p) == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[out_p := 120]; + assume _v2.value_is(_v2.__ctobpl_const_21, out_p); + assume _v2.value_is(_v2.__ctobpl_const_22, _v2.Mem_T.UCHAR[out_p]); + goto label_18#2; + + label_18#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(out_p, 1, 1), 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(_v2.INT_PLUS(out_p, 1, 1)) == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(out_p, 1, 1) := 120]; + assume _v2.value_is(_v2.__ctobpl_const_23, out_p); + assume _v2.value_is(_v2.__ctobpl_const_24, _v2.Mem_T.UCHAR[_v2.INT_PLUS(out_p, 1, 1)]); + goto label_19#2; + + label_19#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 33} true; + out_tempBoogie0 := _v2.INT_PLUS(out_p, 1, 2); + out_p := out_tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_25, out_p); + goto label_20#2; + + label_20#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 34} true; + havoc out_tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(out_bufsize, 2, 1, out_tempBoogie0); + out_bufsize := out_tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_26, out_bufsize); + goto label_21#2; + + label_21#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + assume _v2.value_is(_v2.__ctobpl_const_27, out_i); + out_i := _v2.INT_PLUS(out_i, 1, 1); + goto label_21_dummy#2; + + label_21_dummy#2: + call out_bufsize, out_i, out_p, out_tempBoogie0 := _v2.encode_ie_loop_label_14_head(out_bufsize, out_i, in_ielen, out_p, out_tempBoogie0); + return; +} + + + +function _v1.ite(b: bool, x: int, y: int) : int; + + +var _v1.OK: bool; + +var {:extern} _v1.Mem: [name][int]int; + +var {:extern} _v1.alloc: int; + +var {:extern} _v1.Mem_T.A1CHAR: [int]int; + +var {:extern} _v1.Mem_T.A5UCHAR: [int]int; + +var {:extern} _v1.Mem_T.A6UCHAR: [int]int; + +var {:extern} _v1.Mem_T.CHAR: [int]int; + +var {:extern} _v1.Mem_T.INT4: [int]int; + +var {:extern} _v1.Mem_T.PCHAR: [int]int; + +var {:extern} _v1.Mem_T.PUCHAR: [int]int; + +var {:extern} _v1.Mem_T.PVOID: [int]int; + +var {:extern} _v1.Mem_T.Pieee80211_scan_entry: [int]int; + +var {:extern} _v1.Mem_T.UCHAR: [int]int; + +var {:extern} _v1.Mem_T.VOID: [int]int; + +var {:extern} _v1.Mem_T.ieee80211_scan_entry: [int]int; + +var {:extern} _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + +var {:extern} _v1.detChoiceCnt: int; + +var {:extern} _v1.Res_KERNEL_SOURCE: [int]int; + +var {:extern} _v1.Res_PROBED: [int]int; + +const {:extern} unique _v1.T.se_rsn_ie_ieee80211_scan_entry: name; + +const {:extern} unique _v1.T.A1CHAR: name; + +const {:extern} unique _v1.T.A5UCHAR: name; + +const {:extern} unique _v1.T.A6UCHAR: name; + +const {:extern} unique _v1.T.CHAR: name; + +const {:extern} unique _v1.T.INT4: name; + +const {:extern} unique _v1.T.PA1CHAR: name; + +const {:extern} unique _v1.T.PA5UCHAR: name; + +const {:extern} unique _v1.T.PA6UCHAR: name; + +const {:extern} unique _v1.T.PCHAR: name; + +const {:extern} unique _v1.T.PINT4: name; + +const {:extern} unique _v1.T.PPCHAR: name; + +const {:extern} unique _v1.T.PPUCHAR: name; + +const {:extern} unique _v1.T.PPVOID: name; + +const {:extern} unique _v1.T.PPieee80211_scan_entry: name; + +const {:extern} unique _v1.T.PUCHAR: name; + +const {:extern} unique _v1.T.PUINT4: name; + +const {:extern} unique _v1.T.PVOID: name; + +const {:extern} unique _v1.T.Pieee80211_scan_entry: name; + +const {:extern} unique _v1.T.UCHAR: name; + +const {:extern} unique _v1.T.UINT4: name; + +const {:extern} unique _v1.T.VOID: name; + +const {:extern} unique _v1.T.ieee80211_scan_entry: name; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 16} unique _v1.__ctobpl_const_5: int; + +const {:extern} {:model_const "leader"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 16} unique _v1.__ctobpl_const_6: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 16} unique _v1.__ctobpl_const_7: int; + +const {:extern} {:model_const "leader"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 16} unique _v1.__ctobpl_const_9: int; + +const {:extern} {:model_const "bufsize"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 13} unique _v1.__ctobpl_const_1: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 16} unique _v1.__ctobpl_const_8: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 16} unique _v1.__ctobpl_const_10: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 13} unique _v1.__ctobpl_const_2: int; + +const {:extern} {:model_const "*(p + 1)"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 32} unique _v1.__ctobpl_const_24: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 33} unique _v1.__ctobpl_const_25: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 20} unique _v1.__ctobpl_const_26: int; + +const {:extern} {:model_const "result.question.3"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 38} unique _v1.__ctobpl_const_28: int; + +const {:extern} {:model_const "bufsize"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 17} unique _v1.__ctobpl_const_11: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 32} unique _v1.__ctobpl_const_23: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 18} unique _v1.__ctobpl_const_13: int; + +const {:extern} {:model_const "buf"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 38} unique _v1.__ctobpl_const_30: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 50} unique _v1.__ctobpl_const_32: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 17} unique _v1.__ctobpl_const_12: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 50} unique _v1.__ctobpl_const_33: int; + +const {:extern} {:model_const "bufsize"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 20} unique _v1.__ctobpl_const_20: int; + +const {:extern} {:model_const "*p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 30} unique _v1.__ctobpl_const_22: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 38} unique _v1.__ctobpl_const_18: int; + +const {:extern} {:model_const "result.question.3"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 38} unique _v1.__ctobpl_const_31: int; + +const {:extern} {:model_const "ielen"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 38} unique _v1.__ctobpl_const_19: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 20} unique _v1.__ctobpl_const_16: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 30} unique _v1.__ctobpl_const_21: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 38} unique _v1.__ctobpl_const_29: int; + +const {:extern} {:model_const "result.question.3"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 38} unique _v1.__ctobpl_const_27: int; + +const {:extern} {:model_const "ielen"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 20} unique _v1.__ctobpl_const_17: int; + +const {:extern} {:model_const "leader_len"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 18} unique _v1.__ctobpl_const_14: int; + +const {:extern} {:model_const "i"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 20} unique _v1.__ctobpl_const_15: int; + +const {:extern} {:model_const "p"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 15} unique _v1.__ctobpl_const_3: int; + +const {:extern} {:model_const "buf"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 15} unique _v1.__ctobpl_const_4: int; + +const {:extern} {:model_const "se.se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 66} unique _v1.__ctobpl_const_50: int; + +const {:extern} {:model_const "(se.se_rsn_ie)[0]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 65} unique _v1.__ctobpl_const_49: int; + +const {:extern} {:model_const "se.se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 65} unique _v1.__ctobpl_const_48: int; + +const {:extern} {:model_const "(se.se_rsn_ie)[1]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 66} unique _v1.__ctobpl_const_51: int; + +const {:extern} {:model_const "se.se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 64} unique _v1.__ctobpl_const_47: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 52} unique _v1.__ctobpl_const_41: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 52} unique _v1.__ctobpl_const_42: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 52} unique _v1.__ctobpl_const_45: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 51} unique _v1.__ctobpl_const_35: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 52} unique _v1.__ctobpl_const_44: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 51} unique _v1.__ctobpl_const_34: int; + +const {:extern} {:model_const "(se->se_rsn_ie)[1]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 53} unique _v1.__ctobpl_const_40: int; + +const {:extern} {:model_const "se"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 53} unique _v1.__ctobpl_const_38: int; + +const {:extern} {:model_const "encode_ie.arg.4"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 52} unique _v1.__ctobpl_const_43: int; + +const {:extern} {:model_const "encode_ie.arg.4"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 52} unique _v1.__ctobpl_const_46: int; + +const {:extern} {:model_const "(se->se_rsn_ie)[0]"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 51} unique _v1.__ctobpl_const_36: int; + +const {:extern} {:model_const "encode_ie.arg.4"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 53} unique _v1.__ctobpl_const_37: int; + +const {:extern} {:model_const "se->se_rsn_ie"} {:sourceFile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceLine 53} unique _v1.__ctobpl_const_39: int; + +function {:inline true} _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(a : int, b : int, size : int, result : int) : bool +{ + (size * result <= a - b) && (a - b < size * (result + 1)) +} + + + +procedure _v1.havoc_assert(i: int); + /* free */ requires i != 0; + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.havoc_assume(i: int); + /* free */ ensures i != 0; + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.__HAVOC_free(a: int); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.__HAVOC_malloc(obj_size: int) returns (new: int); + /* free */ requires _v2.INT_GEQ(obj_size, 0); + modifies _v1.alloc; + /* free */ ensures new == old(_v1.alloc); + /* free */ ensures _v2.INT_GT(_v1.alloc, _v2.INT_ADD(new, obj_size)); + /* free */ ensures _v2.Base(new) == new; + /* free */ ensures _v2.INT_GEQ(new, 0); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.__HAVOC_det_malloc(obj_size: int) returns (new: int); + /* free */ requires _v2.INT_GEQ(obj_size, 0); + modifies _v1.alloc; + /* free */ ensures new == old(_v1.alloc); + /* free */ ensures _v2.INT_GT(_v1.alloc, _v2.INT_ADD(new, obj_size)); + /* free */ ensures _v2.Base(new) == new; + /* free */ ensures _v1.alloc == _v2.NewAlloc(old(_v1.alloc), obj_size); + /* free */ ensures _v2.INT_GEQ(new, 0); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + + +procedure _v1.nondet_choice() returns (x: int); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.det_choice() returns (x: int); + modifies _v1.detChoiceCnt; + /* free */ ensures _v1.detChoiceCnt == _v2.INT_ADD(old(_v1.detChoiceCnt), 1); + /* free */ ensures x == _v2.DetChoiceFunc(old(_v1.detChoiceCnt)); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1._strdup(str: int) returns (new: int); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1._xstrcasecmp(a0: int, a1: int) returns (ret: int); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1._xstrcmp(a0: int, a1: int) returns (ret: int); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.memcpy(a0: int, a1: int, a2: int) returns (ret: int); + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.encode_ie(buf_.1: int, + bufsize_.1: int, + ie_.1: int, + ielen_.1: int, + leader_.1: int, + leader_len_.1: int) + returns (result.encode_ie$1: int); + modifies _v1.OK, _v1.Mem_T.UCHAR; + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.giwscan_cb(se_.1: int) returns (result.giwscan_cb$1: int); + modifies _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.main() returns (result.main$1: int); + modifies _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +procedure _v1.encode_ie_loop_label_14_head(in_bufsize: int, in_i: int, in_ielen: int, in_p: int, in_tempBoogie0: int) + returns (out_i: int, out_p: int, out_tempBoogie0: int); + modifies _v1.Mem_T.UCHAR, _v1.OK; + /* free */ ensures _v1.OK ==> old(_v1.OK); + + + +implementation _v1.encode_ie(buf_.1: int, + bufsize_.1: int, + ie_.1: int, + ielen_.1: int, + leader_.1: int, + leader_len_.1: int) + returns (result.encode_ie$1: int) +{ + var {:extern} havoc_stringTemp: int; + var {:extern} condVal: int; + var {:extern} buf: int; + var {:extern} bufsize: int; + var {:extern} i: int; + var {:extern} ie: int; + var {:extern} ielen: int; + var {:extern} leader: int; + var {:extern} leader_len: int; + var {:extern} p: int; + var {:extern} result.memcpy$2: int; + var {:extern} $result.question.3.$$static$: int; + var {:extern} tempBoogie0: int; + var {:extern} tempBoogie1: int; + var {:extern} tempBoogie2: int; + var {:extern} tempBoogie3: int; + var {:extern} tempBoogie4: int; + var {:extern} tempBoogie5: int; + var {:extern} tempBoogie6: int; + var {:extern} tempBoogie7: int; + var {:extern} tempBoogie8: int; + var {:extern} tempBoogie9: int; + var {:extern} tempBoogie10: int; + var {:extern} tempBoogie11: int; + var {:extern} tempBoogie12: int; + var {:extern} tempBoogie13: int; + var {:extern} tempBoogie14: int; + var {:extern} tempBoogie15: int; + var {:extern} tempBoogie16: int; + var {:extern} tempBoogie17: int; + var {:extern} tempBoogie18: int; + var {:extern} tempBoogie19: int; + var {:extern} __havoc_dummy_return: int; + + anon0#2: + havoc_stringTemp := 0; + goto start#2; + + start#2: + assume _v2.INT_LT(buf_.1, _v1.alloc); + assume _v2.INT_LT(ie_.1, _v1.alloc); + assume _v2.INT_LT(leader_.1, _v1.alloc); + buf := 0; + assume _v2.INT_GEQ(buf_.1, 0); + bufsize := 0; + i := 0; + ie := 0; + assume _v2.INT_GEQ(ie_.1, 0); + ielen := 0; + leader := 0; + assume _v2.INT_GEQ(leader_.1, 0); + leader_len := 0; + p := 0; + result.encode_ie$1 := 0; + result.memcpy$2 := 0; + $result.question.3.$$static$ := 0; + buf := buf_.1; + bufsize := bufsize_.1; + ie := ie_.1; + ielen := ielen_.1; + leader := leader_.1; + leader_len := leader_len_.1; + goto label_3#2; + + label_3#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 9} true; + goto label_4#2; + + label_4#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 10} true; + goto label_5#2; + + label_5#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 13} true; + goto label_5_true#2, label_5_false#2; + + label_5_false#2: + assume !_v2.INT_LT(bufsize, leader_len); + assume _v2.value_is(_v1.__ctobpl_const_1, bufsize); + assume _v2.value_is(_v1.__ctobpl_const_2, leader_len); + goto label_6#2; + + label_6#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 15} true; + p := buf; + assume _v2.value_is(_v1.__ctobpl_const_3, p); + assume _v2.value_is(_v1.__ctobpl_const_4, buf); + goto label_8#2; + + label_8#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 16} true; + call result.memcpy$2 := _v1.memcpy(p, leader, leader_len); + assume _v2.value_is(_v1.__ctobpl_const_5, p); + assume _v2.value_is(_v1.__ctobpl_const_6, leader); + assume _v2.value_is(_v1.__ctobpl_const_7, leader_len); + assume _v2.value_is(_v1.__ctobpl_const_8, p); + assume _v2.value_is(_v1.__ctobpl_const_9, leader); + assume _v2.value_is(_v1.__ctobpl_const_10, leader_len); + goto label_11#2; + + label_11#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 17} true; + havoc tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(bufsize, leader_len, 1, tempBoogie0); + bufsize := tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_11, bufsize); + assume _v2.value_is(_v1.__ctobpl_const_12, leader_len); + goto label_12#2; + + label_12#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 18} true; + tempBoogie0 := _v2.INT_PLUS(p, 1, leader_len); + p := tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_13, p); + assume _v2.value_is(_v1.__ctobpl_const_14, leader_len); + goto label_13#2; + + label_13#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + i := 0; + assume _v2.value_is(_v1.__ctobpl_const_15, i); + goto label_14#2; + + label_14#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + goto label_14_head#2; + + label_14_head#2: + call i, p, tempBoogie0 := _v1.encode_ie_loop_label_14_head(bufsize, i, ielen, p, tempBoogie0); + goto label_14_head_last#2; + + label_14_head_last#2: + goto label_14_true#2, label_14_false#2; + + label_14_false#2: + assume !_v2.INT_LT(i, ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, i); + assume _v2.value_is(_v1.__ctobpl_const_17, ielen); + goto label_15#2; + + label_14_true#2: + assume _v2.INT_LT(i, ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, i); + assume _v2.value_is(_v1.__ctobpl_const_17, ielen); + goto label_16#2; + + label_16#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + goto label_16_true#2, label_16_false#2; + + label_16_false#2: + assume !_v2.INT_LT(2, bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, bufsize); + goto label_15#2; + + label_15#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + goto label_15_true#2, label_15_false#2; + + label_15_false#2: + assume !_v2.INT_EQ(i, ielen); + assume _v2.value_is(_v1.__ctobpl_const_18, i); + assume _v2.value_is(_v1.__ctobpl_const_19, ielen); + goto label_21#2; + + label_21#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + $result.question.3.$$static$ := 0; + assume _v2.value_is(_v1.__ctobpl_const_27, $result.question.3.$$static$); + goto label_23#2; + + label_15_true#2: + assume _v2.INT_EQ(i, ielen); + assume _v2.value_is(_v1.__ctobpl_const_18, i); + assume _v2.value_is(_v1.__ctobpl_const_19, ielen); + goto label_22#2; + + label_22#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + havoc $result.question.3.$$static$; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(p, buf, 1, $result.question.3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_28, $result.question.3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_29, p); + assume _v2.value_is(_v1.__ctobpl_const_30, buf); + goto label_23#2; + + label_23#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + result.encode_ie$1 := $result.question.3.$$static$; + assume _v2.value_is(_v1.__ctobpl_const_31, $result.question.3.$$static$); + goto label_1#2; + + label_16_true#2: + assume _v2.INT_LT(2, bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, bufsize); + goto label_17#2; + + label_17#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(p, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(p) == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[p := 120]; + assume _v2.value_is(_v1.__ctobpl_const_21, p); + assume _v2.value_is(_v1.__ctobpl_const_22, _v1.Mem_T.UCHAR[p]); + goto label_18#2; + + label_18#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(p, 1, 1), 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.INT_PLUS(p, 1, 1)) == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(p, 1, 1) := 120]; + assume _v2.value_is(_v1.__ctobpl_const_23, p); + assume _v2.value_is(_v1.__ctobpl_const_24, _v1.Mem_T.UCHAR[_v2.INT_PLUS(p, 1, 1)]); + goto label_19#2; + + label_19#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 33} true; + tempBoogie0 := _v2.INT_PLUS(p, 1, 2); + p := tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_25, p); + goto label_20#2; + + label_20#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + assume _v2.value_is(_v1.__ctobpl_const_26, i); + i := _v2.INT_PLUS(i, 1, 1); + goto label_20_dummy#2; + + label_20_dummy#2: + assume false; + return; + + label_5_true#2: + assume _v2.INT_LT(bufsize, leader_len); + assume _v2.value_is(_v1.__ctobpl_const_1, bufsize); + assume _v2.value_is(_v1.__ctobpl_const_2, leader_len); + goto label_7#2; + + label_7#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 14} true; + result.encode_ie$1 := 0; + goto label_1#2; + + label_1#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 39} true; + return; +} + + + +implementation _v1.giwscan_cb(se_.1: int) returns (result.giwscan_cb$1: int) +{ + var {:extern} havoc_stringTemp: int; + var {:extern} condVal: int; + var {:extern} buf: int; + var {:extern} $encode_ie.arg.4$3.$$static$: int; + var {:extern} result.encode_ie$2: int; + var {:extern} rsn_leader: int; + var {:extern} se: int; + var {:extern} tempBoogie0: int; + var {:extern} tempBoogie1: int; + var {:extern} tempBoogie2: int; + var {:extern} tempBoogie3: int; + var {:extern} tempBoogie4: int; + var {:extern} tempBoogie5: int; + var {:extern} tempBoogie6: int; + var {:extern} tempBoogie7: int; + var {:extern} tempBoogie8: int; + var {:extern} tempBoogie9: int; + var {:extern} tempBoogie10: int; + var {:extern} tempBoogie11: int; + var {:extern} tempBoogie12: int; + var {:extern} tempBoogie13: int; + var {:extern} tempBoogie14: int; + var {:extern} tempBoogie15: int; + var {:extern} tempBoogie16: int; + var {:extern} tempBoogie17: int; + var {:extern} tempBoogie18: int; + var {:extern} tempBoogie19: int; + var {:extern} __havoc_dummy_return: int; + + anon0#2: + havoc_stringTemp := 0; + goto start#2; + + start#2: + assume _v2.INT_LT(se_.1, _v1.alloc); + call buf := _v1.__HAVOC_det_malloc(6); + $encode_ie.arg.4$3.$$static$ := 0; + result.encode_ie$2 := 0; + result.giwscan_cb$1 := 0; + call rsn_leader := _v1.__HAVOC_det_malloc(1); + se := 0; + assume _v2.INT_GEQ(se_.1, 0); + se := se_.1; + goto label_3#2; + + label_3#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 45} true; + goto label_4#2; + + label_4#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 46} true; + goto label_5#2; + + label_5#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 50} true; + assume _v2.INT_GEQ(se, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + goto label_5_true#2, label_5_false#2; + + label_5_false#2: + assume _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)] + == 0; + assume _v2.value_is(_v1.__ctobpl_const_32, se); + assume _v2.value_is(_v1.__ctobpl_const_33, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + goto label_6#2; + + label_5_true#2: + assume _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)] + != 0; + assume _v2.value_is(_v1.__ctobpl_const_32, se); + assume _v2.value_is(_v1.__ctobpl_const_33, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + goto label_7#2; + + label_7#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 51} true; + assume _v2.INT_GEQ(se, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)) + == 1; + assert true; + goto label_7_true#2, label_7_false#2; + + label_7_false#2: + assume !_v2.INT_EQ(_v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)], + 200); + assume _v2.value_is(_v1.__ctobpl_const_34, se); + assume _v2.value_is(_v1.__ctobpl_const_35, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v1.__ctobpl_const_36, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)]); + goto label_6#2; + + label_7_true#2: + assume _v2.INT_EQ(_v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)], + 200); + assume _v2.value_is(_v1.__ctobpl_const_34, se); + assume _v2.value_is(_v1.__ctobpl_const_35, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v1.__ctobpl_const_36, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)]); + goto label_8#2; + + label_8#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 53} true; + assume _v2.INT_GEQ(se, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)) + == 1; + assert true; + $encode_ie.arg.4$3.$$static$ := _v2.INT_PLUS(_v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)], + 1, + 2); + assume _v2.value_is(_v1.__ctobpl_const_37, $encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_38, se); + assume _v2.value_is(_v1.__ctobpl_const_39, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v1.__ctobpl_const_40, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)]); + goto label_9#2; + + label_9#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 52} true; + assume _v2.INT_GEQ(se, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(se, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + call result.encode_ie$2 := _v1.encode_ie(buf, 6, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], $encode_ie.arg.4$3.$$static$, rsn_leader, 1); + assume _v2.value_is(_v1.__ctobpl_const_41, se); + assume _v2.value_is(_v1.__ctobpl_const_42, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v1.__ctobpl_const_43, $encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_44, se); + assume _v2.value_is(_v1.__ctobpl_const_45, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v1.__ctobpl_const_46, $encode_ie.arg.4$3.$$static$); + goto label_6#2; + + label_6#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 57} true; + result.giwscan_cb$1 := 0; + goto label_1#2; + + label_1#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 58} true; + call _v1.__HAVOC_free(buf); + call _v1.__HAVOC_free(rsn_leader); + return; +} + + + +implementation _v1.main() returns (result.main$1: int) +{ + var {:extern} havoc_stringTemp: int; + var {:extern} condVal: int; + var {:extern} ie: int; + var {:extern} result.giwscan_cb$2: int; + var {:extern} se: int; + var {:extern} tempBoogie0: int; + var {:extern} tempBoogie1: int; + var {:extern} tempBoogie2: int; + var {:extern} tempBoogie3: int; + var {:extern} tempBoogie4: int; + var {:extern} tempBoogie5: int; + var {:extern} tempBoogie6: int; + var {:extern} tempBoogie7: int; + var {:extern} tempBoogie8: int; + var {:extern} tempBoogie9: int; + var {:extern} tempBoogie10: int; + var {:extern} tempBoogie11: int; + var {:extern} tempBoogie12: int; + var {:extern} tempBoogie13: int; + var {:extern} tempBoogie14: int; + var {:extern} tempBoogie15: int; + var {:extern} tempBoogie16: int; + var {:extern} tempBoogie17: int; + var {:extern} tempBoogie18: int; + var {:extern} tempBoogie19: int; + var {:extern} __havoc_dummy_return: int; + + anon0#2: + havoc_stringTemp := 0; + goto start#2; + + start#2: + call ie := _v1.__HAVOC_det_malloc(5); + result.giwscan_cb$2 := 0; + result.main$1 := 0; + call se := _v1.__HAVOC_det_malloc(4); + goto label_3#2; + + label_3#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 62} true; + goto label_4#2; + + label_4#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 63} true; + goto label_5#2; + + label_5#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 64} true; + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry := _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se) := ie]; + assume _v2.value_is(_v1.__ctobpl_const_47, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + goto label_6#2; + + label_6#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 65} true; + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)) + == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0) := 200]; + assume _v2.value_is(_v1.__ctobpl_const_48, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v1.__ctobpl_const_49, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 0)]); + goto label_7#2; + + label_7#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 66} true; + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(se)) == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)) + == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1) := 3]; + assume _v2.value_is(_v1.__ctobpl_const_50, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)]); + assume _v2.value_is(_v1.__ctobpl_const_51, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(se)], + 1, + 1)]); + goto label_8#2; + + label_8#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 68} true; + assume _v2.INT_GT(se, 0); + assume _v2.INT_GT(se, 0); + call result.giwscan_cb$2 := _v1.giwscan_cb(se); + goto label_11#2; + + label_11#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 70} true; + result.main$1 := 0; + goto label_1#2; + + label_1#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 71} true; + call _v1.__HAVOC_free(ie); + call _v1.__HAVOC_free(se); + return; +} + + + +implementation _v1.encode_ie_loop_label_14_head(in_bufsize: int, in_i: int, in_ielen: int, in_p: int, in_tempBoogie0: int) + returns (out_i: int, out_p: int, out_tempBoogie0: int) +{ + + entry#2: + out_i, out_p, out_tempBoogie0 := in_i, in_p, in_tempBoogie0; + goto label_14_head#2; + + label_14_head#2: + goto label_14_true#2, label_14_false#2; + + label_14_false#2: + assume !_v2.INT_LT(out_i, in_ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, out_i); + assume _v2.value_is(_v1.__ctobpl_const_17, in_ielen); + out_i, out_p, out_tempBoogie0 := in_i, in_p, in_tempBoogie0; + _v1.Mem_T.UCHAR := old(_v1.Mem_T.UCHAR); + return; + + label_14_true#2: + assume _v2.INT_LT(out_i, in_ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, out_i); + assume _v2.value_is(_v1.__ctobpl_const_17, in_ielen); + goto label_16#2; + + label_16#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + goto label_16_true#2, label_16_false#2; + + label_16_false#2: + assume !_v2.INT_LT(2, in_bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, in_bufsize); + out_i, out_p, out_tempBoogie0 := in_i, in_p, in_tempBoogie0; + _v1.Mem_T.UCHAR := old(_v1.Mem_T.UCHAR); + return; + + label_16_true#2: + assume _v2.INT_LT(2, in_bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, in_bufsize); + goto label_17#2; + + label_17#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(out_p, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(out_p) == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[out_p := 120]; + assume _v2.value_is(_v1.__ctobpl_const_21, out_p); + assume _v2.value_is(_v1.__ctobpl_const_22, _v1.Mem_T.UCHAR[out_p]); + goto label_18#2; + + label_18#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(out_p, 1, 1), 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(_v2.INT_PLUS(out_p, 1, 1)) == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(out_p, 1, 1) := 120]; + assume _v2.value_is(_v1.__ctobpl_const_23, out_p); + assume _v2.value_is(_v1.__ctobpl_const_24, _v1.Mem_T.UCHAR[_v2.INT_PLUS(out_p, 1, 1)]); + goto label_19#2; + + label_19#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 33} true; + out_tempBoogie0 := _v2.INT_PLUS(out_p, 1, 2); + out_p := out_tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_25, out_p); + goto label_20#2; + + label_20#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + assume _v2.value_is(_v1.__ctobpl_const_26, out_i); + out_i := _v2.INT_PLUS(out_i, 1, 1); + goto label_20_dummy#2; + + label_20_dummy#2: + call out_i, out_p, out_tempBoogie0 := _v1.encode_ie_loop_label_14_head(in_bufsize, out_i, in_ielen, out_p, out_tempBoogie0); + return; +} + + + +type {:extern} name; + +type {:extern} byte; + +function {:inline true} MS$_v1.havoc_assert$_v2.havoc_assert(_v1.i: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v2.i: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int) + : bool +{ + true +} + +procedure MS_Check__v1.havoc_assert___v2.havoc_assert(_v1.i: int, _v2.i: int); + requires _v1.i == _v2.i + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.havoc_assert$_v2.havoc_assert(_v1.i, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v2.i, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED)); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.havoc_assume$_v2.havoc_assume(_v1.i: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v2.i: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int) + : bool +{ + true +} + +procedure MS_Check__v1.havoc_assume___v2.havoc_assume(_v1.i: int, _v2.i: int); + requires _v1.i == _v2.i + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.havoc_assume$_v2.havoc_assume(_v1.i, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v2.i, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED)); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.__HAVOC_free$_v2.__HAVOC_free(_v1.a: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v2.a: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int) + : bool +{ + true +} + +const {:existential true} _houdini_0: bool; + +const {:existential true} _houdini_1: bool; + +const {:existential true} _houdini_2: bool; + +const {:existential true} _houdini_3: bool; + +const {:existential true} _houdini_4: bool; + +const {:existential true} _houdini_5: bool; + +const {:existential true} _houdini_6: bool; + +const {:existential true} _houdini_7: bool; + +const {:existential true} _houdini_8: bool; + +const {:existential true} _houdini_9: bool; + +const {:existential true} _houdini_10: bool; + +const {:existential true} _houdini_11: bool; + +const {:existential true} _houdini_12: bool; + +const {:existential true} _houdini_13: bool; + +const {:existential true} _houdini_14: bool; + +const {:existential true} _houdini_15: bool; + +const {:existential true} _houdini_16: bool; + +const {:existential true} _houdini_17: bool; + +const {:existential true} _houdini_18: bool; + +const {:existential true} _houdini_19: bool; + +const {:existential true} _houdini_20: bool; + +const {:existential true} _houdini_21: bool; + +const {:existential true} _houdini_22: bool; + +const {:existential true} _houdini_23: bool; + +procedure MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.a: int, _v2.a: int); + requires _houdini_0 ==> _v1.a <= _v2.a; + requires _houdini_1 ==> _v2.a <= _v1.a; + requires _houdini_2 ==> _v1.OK ==> _v2.OK; + requires _houdini_3 ==> _v2.OK ==> _v1.OK; + requires _houdini_4 ==> _v1.Mem == _v2.Mem; + requires _houdini_5 ==> _v1.alloc <= _v2.alloc; + requires _houdini_6 ==> _v2.alloc <= _v1.alloc; + requires _houdini_7 ==> _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR; + requires _houdini_8 ==> _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR; + requires _houdini_9 ==> _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR; + requires _houdini_10 ==> _v1.Mem_T.CHAR == _v2.Mem_T.CHAR; + requires _houdini_11 ==> _v1.Mem_T.INT4 == _v2.Mem_T.INT4; + requires _houdini_12 ==> _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR; + requires _houdini_13 ==> _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR; + requires _houdini_14 ==> _v1.Mem_T.PVOID == _v2.Mem_T.PVOID; + requires _houdini_15 + ==> _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry; + requires _houdini_16 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + requires _houdini_17 ==> _v1.Mem_T.VOID == _v2.Mem_T.VOID; + requires _houdini_18 ==> _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry; + requires _houdini_19 + ==> _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry; + requires _houdini_20 ==> _v1.detChoiceCnt <= _v2.detChoiceCnt; + requires _houdini_21 ==> _v2.detChoiceCnt <= _v1.detChoiceCnt; + requires _houdini_22 ==> _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE; + requires _houdini_23 ==> _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.__HAVOC_free$_v2.__HAVOC_free(_v1.a, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v2.a, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED)); + ensures old(_v1.a == _v2.a) ==> true; + + + +function {:inline true} MS$_v1.__HAVOC_malloc$_v2.__HAVOC_malloc(_v1.obj_size: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.alloc_: int, + _v1.new: int, + _v2.obj_size: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.alloc_: int, + _v2.new: int) + : bool +{ + true +} + +procedure MS_Check__v1.__HAVOC_malloc___v2.__HAVOC_malloc(_v1.obj_size: int, _v2.obj_size: int) returns (_v1.new: int, _v2.new: int); + requires _v1.obj_size == _v2.obj_size + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + modifies _v1.alloc, _v2.alloc; + ensures MS$_v1.__HAVOC_malloc$_v2.__HAVOC_malloc(_v1.obj_size, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.alloc, + _v1.new, + _v2.obj_size, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.alloc, + _v2.new); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.__HAVOC_det_malloc$_v2.__HAVOC_det_malloc(_v1.obj_size: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.alloc_: int, + _v1.new: int, + _v2.obj_size: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.alloc_: int, + _v2.new: int) + : bool +{ + true +} + +const {:existential true} _houdini_24: bool; + +const {:existential true} _houdini_25: bool; + +const {:existential true} _houdini_26: bool; + +const {:existential true} _houdini_27: bool; + +const {:existential true} _houdini_28: bool; + +const {:existential true} _houdini_29: bool; + +const {:existential true} _houdini_30: bool; + +const {:existential true} _houdini_31: bool; + +const {:existential true} _houdini_32: bool; + +const {:existential true} _houdini_33: bool; + +const {:existential true} _houdini_34: bool; + +const {:existential true} _houdini_35: bool; + +const {:existential true} _houdini_36: bool; + +const {:existential true} _houdini_37: bool; + +const {:existential true} _houdini_38: bool; + +const {:existential true} _houdini_39: bool; + +const {:existential true} _houdini_40: bool; + +const {:existential true} _houdini_41: bool; + +const {:existential true} _houdini_42: bool; + +const {:existential true} _houdini_43: bool; + +const {:existential true} _houdini_44: bool; + +const {:existential true} _houdini_45: bool; + +const {:existential true} _houdini_46: bool; + +const {:existential true} _houdini_47: bool; + +procedure MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.obj_size: int, _v2.obj_size: int) returns (_v1.new: int, _v2.new: int); + requires _houdini_24 ==> _v1.obj_size <= _v2.obj_size; + requires _houdini_25 ==> _v2.obj_size <= _v1.obj_size; + requires _houdini_26 ==> _v1.OK ==> _v2.OK; + requires _houdini_27 ==> _v2.OK ==> _v1.OK; + requires _houdini_28 ==> _v1.Mem == _v2.Mem; + requires _houdini_29 ==> _v1.alloc <= _v2.alloc; + requires _houdini_30 ==> _v2.alloc <= _v1.alloc; + requires _houdini_31 ==> _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR; + requires _houdini_32 ==> _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR; + requires _houdini_33 ==> _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR; + requires _houdini_34 ==> _v1.Mem_T.CHAR == _v2.Mem_T.CHAR; + requires _houdini_35 ==> _v1.Mem_T.INT4 == _v2.Mem_T.INT4; + requires _houdini_36 ==> _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR; + requires _houdini_37 ==> _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR; + requires _houdini_38 ==> _v1.Mem_T.PVOID == _v2.Mem_T.PVOID; + requires _houdini_39 + ==> _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry; + requires _houdini_40 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + requires _houdini_41 ==> _v1.Mem_T.VOID == _v2.Mem_T.VOID; + requires _houdini_42 ==> _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry; + requires _houdini_43 + ==> _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry; + requires _houdini_44 ==> _v1.detChoiceCnt <= _v2.detChoiceCnt; + requires _houdini_45 ==> _v2.detChoiceCnt <= _v1.detChoiceCnt; + requires _houdini_46 ==> _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE; + requires _houdini_47 ==> _v1.Res_PROBED == _v2.Res_PROBED; + modifies _v1.alloc, _v2.alloc; + ensures MS$_v1.__HAVOC_det_malloc$_v2.__HAVOC_det_malloc(_v1.obj_size, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.alloc, + _v1.new, + _v2.obj_size, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.alloc, + _v2.new); + ensures old(_v1.obj_size == _v2.obj_size && _v1.alloc == _v2.alloc) + ==> _v1.new <= _v2.new + && _v2.new <= _v1.new + && _v1.alloc <= _v2.alloc + && _v2.alloc <= _v1.alloc; + + + +function {:inline true} MS$_v1.__HAVOC_memset_split_1$_v2.__HAVOC_memset_split_1(_v1.A: [int]int, + _v1.p: int, + _v1.c: int, + _v1.n: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.ret: [int]int, + _v2.A: [int]int, + _v2.p: int, + _v2.c: int, + _v2.n: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.ret: [int]int) + : bool +{ + true +} + +procedure MS_Check__v1.__HAVOC_memset_split_1___v2.__HAVOC_memset_split_1(_v1.A: [int]int, + _v1.p: int, + _v1.c: int, + _v1.n: int, + _v2.A: [int]int, + _v2.p: int, + _v2.c: int, + _v2.n: int) + returns (_v1.ret: [int]int, _v2.ret: [int]int); + requires _v1.A == _v2.A + && _v1.p == _v2.p + && _v1.c == _v2.c + && _v1.n == _v2.n + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.__HAVOC_memset_split_1$_v2.__HAVOC_memset_split_1(_v1.A, + _v1.p, + _v1.c, + _v1.n, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.ret, + _v2.A, + _v2.p, + _v2.c, + _v2.n, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.ret); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.__HAVOC_memset_split_2$_v2.__HAVOC_memset_split_2(_v1.A: [int]int, + _v1.p: int, + _v1.c: int, + _v1.n: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.ret: [int]int, + _v2.A: [int]int, + _v2.p: int, + _v2.c: int, + _v2.n: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.ret: [int]int) + : bool +{ + true +} + +procedure MS_Check__v1.__HAVOC_memset_split_2___v2.__HAVOC_memset_split_2(_v1.A: [int]int, + _v1.p: int, + _v1.c: int, + _v1.n: int, + _v2.A: [int]int, + _v2.p: int, + _v2.c: int, + _v2.n: int) + returns (_v1.ret: [int]int, _v2.ret: [int]int); + requires _v1.A == _v2.A + && _v1.p == _v2.p + && _v1.c == _v2.c + && _v1.n == _v2.n + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.__HAVOC_memset_split_2$_v2.__HAVOC_memset_split_2(_v1.A, + _v1.p, + _v1.c, + _v1.n, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.ret, + _v2.A, + _v2.p, + _v2.c, + _v2.n, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.ret); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.__HAVOC_memset_split_4$_v2.__HAVOC_memset_split_4(_v1.A: [int]int, + _v1.p: int, + _v1.c: int, + _v1.n: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.ret: [int]int, + _v2.A: [int]int, + _v2.p: int, + _v2.c: int, + _v2.n: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.ret: [int]int) + : bool +{ + true +} + +procedure MS_Check__v1.__HAVOC_memset_split_4___v2.__HAVOC_memset_split_4(_v1.A: [int]int, + _v1.p: int, + _v1.c: int, + _v1.n: int, + _v2.A: [int]int, + _v2.p: int, + _v2.c: int, + _v2.n: int) + returns (_v1.ret: [int]int, _v2.ret: [int]int); + requires _v1.A == _v2.A + && _v1.p == _v2.p + && _v1.c == _v2.c + && _v1.n == _v2.n + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.__HAVOC_memset_split_4$_v2.__HAVOC_memset_split_4(_v1.A, + _v1.p, + _v1.c, + _v1.n, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.ret, + _v2.A, + _v2.p, + _v2.c, + _v2.n, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.ret); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.nondet_choice$_v2.nondet_choice(_v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.x: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.x: int) + : bool +{ + true +} + +procedure MS_Check__v1.nondet_choice___v2.nondet_choice() returns (_v1.x: int, _v2.x: int); + requires (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.nondet_choice$_v2.nondet_choice(old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.x, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.x); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.det_choice$_v2.det_choice(_v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.detChoiceCnt_: int, + _v1.x: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.detChoiceCnt_: int, + _v2.x: int) + : bool +{ + true +} + +procedure MS_Check__v1.det_choice___v2.det_choice() returns (_v1.x: int, _v2.x: int); + requires (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + modifies _v1.detChoiceCnt, _v2.detChoiceCnt; + ensures MS$_v1.det_choice$_v2.det_choice(old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.detChoiceCnt, + _v1.x, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.detChoiceCnt, + _v2.x); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1._strdup$_v2._strdup(_v1.str: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.new: int, + _v2.str: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.new: int) + : bool +{ + true +} + +procedure MS_Check__v1._strdup___v2._strdup(_v1.str: int, _v2.str: int) returns (_v1.new: int, _v2.new: int); + requires _v1.str == _v2.str + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1._strdup$_v2._strdup(_v1.str, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.new, + _v2.str, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.new); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1._xstrcasecmp$_v2._xstrcasecmp(_v1.a0: int, + _v1.a1: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.ret: int, + _v2.a0: int, + _v2.a1: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.ret: int) + : bool +{ + true +} + +procedure MS_Check__v1._xstrcasecmp___v2._xstrcasecmp(_v1.a0: int, _v1.a1: int, _v2.a0: int, _v2.a1: int) + returns (_v1.ret: int, _v2.ret: int); + requires _v1.a0 == _v2.a0 + && _v1.a1 == _v2.a1 + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1._xstrcasecmp$_v2._xstrcasecmp(_v1.a0, + _v1.a1, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.ret, + _v2.a0, + _v2.a1, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.ret); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1._xstrcmp$_v2._xstrcmp(_v1.a0: int, + _v1.a1: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.ret: int, + _v2.a0: int, + _v2.a1: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.ret: int) + : bool +{ + true +} + +procedure MS_Check__v1._xstrcmp___v2._xstrcmp(_v1.a0: int, _v1.a1: int, _v2.a0: int, _v2.a1: int) + returns (_v1.ret: int, _v2.ret: int); + requires _v1.a0 == _v2.a0 + && _v1.a1 == _v2.a1 + && + (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1._xstrcmp$_v2._xstrcmp(_v1.a0, + _v1.a1, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.ret, + _v2.a0, + _v2.a1, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.ret); + ensures _v1.OK ==> _v2.OK; + + + +function {:inline true} MS$_v1.memcpy$_v2.memcpy(_v1.a0: int, + _v1.a1: int, + _v1.a2: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.ret: int, + _v2.a0: int, + _v2.a1: int, + _v2.a2: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.ret: int) + : bool +{ + true +} + +const {:existential true} _houdini_48: bool; + +const {:existential true} _houdini_49: bool; + +const {:existential true} _houdini_50: bool; + +const {:existential true} _houdini_51: bool; + +const {:existential true} _houdini_52: bool; + +const {:existential true} _houdini_53: bool; + +const {:existential true} _houdini_54: bool; + +const {:existential true} _houdini_55: bool; + +const {:existential true} _houdini_56: bool; + +const {:existential true} _houdini_57: bool; + +const {:existential true} _houdini_58: bool; + +const {:existential true} _houdini_59: bool; + +const {:existential true} _houdini_60: bool; + +const {:existential true} _houdini_61: bool; + +const {:existential true} _houdini_62: bool; + +const {:existential true} _houdini_63: bool; + +const {:existential true} _houdini_64: bool; + +const {:existential true} _houdini_65: bool; + +const {:existential true} _houdini_66: bool; + +const {:existential true} _houdini_67: bool; + +const {:existential true} _houdini_68: bool; + +const {:existential true} _houdini_69: bool; + +const {:existential true} _houdini_70: bool; + +const {:existential true} _houdini_71: bool; + +const {:existential true} _houdini_72: bool; + +const {:existential true} _houdini_73: bool; + +const {:existential true} _houdini_74: bool; + +const {:existential true} _houdini_75: bool; + +procedure MS_Check__v1.memcpy___v2.memcpy(_v1.a0: int, _v1.a1: int, _v1.a2: int, _v2.a0: int, _v2.a1: int, _v2.a2: int) + returns (_v1.ret: int, _v2.ret: int); + requires _houdini_48 ==> _v1.a0 <= _v2.a0; + requires _houdini_49 ==> _v2.a0 <= _v1.a0; + requires _houdini_50 ==> _v1.a1 <= _v2.a1; + requires _houdini_51 ==> _v2.a1 <= _v1.a1; + requires _houdini_52 ==> _v1.a2 <= _v2.a2; + requires _houdini_53 ==> _v2.a2 <= _v1.a2; + requires _houdini_54 ==> _v1.OK ==> _v2.OK; + requires _houdini_55 ==> _v2.OK ==> _v1.OK; + requires _houdini_56 ==> _v1.Mem == _v2.Mem; + requires _houdini_57 ==> _v1.alloc <= _v2.alloc; + requires _houdini_58 ==> _v2.alloc <= _v1.alloc; + requires _houdini_59 ==> _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR; + requires _houdini_60 ==> _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR; + requires _houdini_61 ==> _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR; + requires _houdini_62 ==> _v1.Mem_T.CHAR == _v2.Mem_T.CHAR; + requires _houdini_63 ==> _v1.Mem_T.INT4 == _v2.Mem_T.INT4; + requires _houdini_64 ==> _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR; + requires _houdini_65 ==> _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR; + requires _houdini_66 ==> _v1.Mem_T.PVOID == _v2.Mem_T.PVOID; + requires _houdini_67 + ==> _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry; + requires _houdini_68 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + requires _houdini_69 ==> _v1.Mem_T.VOID == _v2.Mem_T.VOID; + requires _houdini_70 ==> _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry; + requires _houdini_71 + ==> _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry; + requires _houdini_72 ==> _v1.detChoiceCnt <= _v2.detChoiceCnt; + requires _houdini_73 ==> _v2.detChoiceCnt <= _v1.detChoiceCnt; + requires _houdini_74 ==> _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE; + requires _houdini_75 ==> _v1.Res_PROBED == _v2.Res_PROBED; + ensures MS$_v1.memcpy$_v2.memcpy(_v1.a0, + _v1.a1, + _v1.a2, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.ret, + _v2.a0, + _v2.a1, + _v2.a2, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.ret); + ensures old(_v1.a0 == _v2.a0 && _v1.a1 == _v2.a1 && _v1.a2 == _v2.a2) + ==> _v1.ret <= _v2.ret && _v2.ret <= _v1.ret; + + + +function {:inline true} MS$_v1.encode_ie$_v2.encode_ie(_v1.buf_.1: int, + _v1.bufsize_.1: int, + _v1.ie_.1: int, + _v1.ielen_.1: int, + _v1.leader_.1: int, + _v1.leader_len_.1: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.OK_: bool, + _v1.Mem_T.UCHAR_: [int]int, + _v1.result.encode_ie$1: int, + _v2.buf_.1: int, + _v2.bufsize_.1: int, + _v2.ie_.1: int, + _v2.ielen_.1: int, + _v2.leader_.1: int, + _v2.leader_len_.1: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.OK_: bool, + _v2.Mem_T.UCHAR_: [int]int, + _v2.result.encode_ie$1: int) + : bool +{ + true +} + +const {:existential true} _houdini_76: bool; + +const {:existential true} _houdini_77: bool; + +const {:existential true} _houdini_78: bool; + +const {:existential true} _houdini_79: bool; + +const {:existential true} _houdini_80: bool; + +const {:existential true} _houdini_81: bool; + +const {:existential true} _houdini_82: bool; + +const {:existential true} _houdini_83: bool; + +const {:existential true} _houdini_84: bool; + +const {:existential true} _houdini_85: bool; + +const {:existential true} _houdini_86: bool; + +const {:existential true} _houdini_87: bool; + +const {:existential true} _houdini_88: bool; + +const {:existential true} _houdini_89: bool; + +const {:existential true} _houdini_90: bool; + +const {:existential true} _houdini_91: bool; + +const {:existential true} _houdini_92: bool; + +const {:existential true} _houdini_93: bool; + +const {:existential true} _houdini_94: bool; + +const {:existential true} _houdini_95: bool; + +const {:existential true} _houdini_96: bool; + +const {:existential true} _houdini_97: bool; + +const {:existential true} _houdini_98: bool; + +const {:existential true} _houdini_99: bool; + +const {:existential true} _houdini_100: bool; + +const {:existential true} _houdini_101: bool; + +const {:existential true} _houdini_102: bool; + +const {:existential true} _houdini_103: bool; + +const {:existential true} _houdini_104: bool; + +const {:existential true} _houdini_105: bool; + +const {:existential true} _houdini_106: bool; + +const {:existential true} _houdini_107: bool; + +const {:existential true} _houdini_108: bool; + +const {:existential true} _houdini_109: bool; + +const {:existential true} _houdini_110: bool; + +const {:existential true} _houdini_111: bool; + +const {:existential true} _houdini_112: bool; + +const {:existential true} _houdini_113: bool; + +const {:existential true} _houdini_114: bool; + +procedure MS_Check__v1.encode_ie___v2.encode_ie(_v1.buf_.1: int, + _v1.bufsize_.1: int, + _v1.ie_.1: int, + _v1.ielen_.1: int, + _v1.leader_.1: int, + _v1.leader_len_.1: int, + _v2.buf_.1: int, + _v2.bufsize_.1: int, + _v2.ie_.1: int, + _v2.ielen_.1: int, + _v2.leader_.1: int, + _v2.leader_len_.1: int) + returns (_v1.result.encode_ie$1: int, _v2.result.encode_ie$1: int); + requires _houdini_81 ==> _v1.buf_.1 <= _v2.buf_.1; + requires _houdini_82 ==> _v2.buf_.1 <= _v1.buf_.1; + requires _houdini_83 ==> _v1.bufsize_.1 <= _v2.bufsize_.1; + requires _houdini_84 ==> _v2.bufsize_.1 <= _v1.bufsize_.1; + requires _houdini_85 ==> _v1.ie_.1 <= _v2.ie_.1; + requires _houdini_86 ==> _v2.ie_.1 <= _v1.ie_.1; + requires _houdini_87 ==> _v1.ielen_.1 <= _v2.ielen_.1; + requires _houdini_88 ==> _v2.ielen_.1 <= _v1.ielen_.1; + requires _houdini_89 ==> _v1.leader_.1 <= _v2.leader_.1; + requires _houdini_90 ==> _v2.leader_.1 <= _v1.leader_.1; + requires _houdini_91 ==> _v1.leader_len_.1 <= _v2.leader_len_.1; + requires _houdini_92 ==> _v2.leader_len_.1 <= _v1.leader_len_.1; + requires _houdini_93 ==> _v1.OK ==> _v2.OK; + requires _houdini_94 ==> _v2.OK ==> _v1.OK; + requires _houdini_95 ==> _v1.Mem == _v2.Mem; + requires _houdini_96 ==> _v1.alloc <= _v2.alloc; + requires _houdini_97 ==> _v2.alloc <= _v1.alloc; + requires _houdini_98 ==> _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR; + requires _houdini_99 ==> _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR; + requires _houdini_100 ==> _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR; + requires _houdini_101 ==> _v1.Mem_T.CHAR == _v2.Mem_T.CHAR; + requires _houdini_102 ==> _v1.Mem_T.INT4 == _v2.Mem_T.INT4; + requires _houdini_103 ==> _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR; + requires _houdini_104 ==> _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR; + requires _houdini_105 ==> _v1.Mem_T.PVOID == _v2.Mem_T.PVOID; + requires _houdini_106 + ==> _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry; + requires _houdini_107 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + requires _houdini_108 ==> _v1.Mem_T.VOID == _v2.Mem_T.VOID; + requires _houdini_109 + ==> _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry; + requires _houdini_110 + ==> _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry; + requires _houdini_111 ==> _v1.detChoiceCnt <= _v2.detChoiceCnt; + requires _houdini_112 ==> _v2.detChoiceCnt <= _v1.detChoiceCnt; + requires _houdini_113 ==> _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE; + requires _houdini_114 ==> _v1.Res_PROBED == _v2.Res_PROBED; + modifies _v1.OK, _v1.Mem_T.UCHAR, _v2.OK, _v2.Mem_T.UCHAR; + ensures MS$_v1.encode_ie$_v2.encode_ie(_v1.buf_.1, + _v1.bufsize_.1, + _v1.ie_.1, + _v1.ielen_.1, + _v1.leader_.1, + _v1.leader_len_.1, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.OK, + _v1.Mem_T.UCHAR, + _v1.result.encode_ie$1, + _v2.buf_.1, + _v2.bufsize_.1, + _v2.ie_.1, + _v2.ielen_.1, + _v2.leader_.1, + _v2.leader_len_.1, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.OK, + _v2.Mem_T.UCHAR, + _v2.result.encode_ie$1); + ensures _houdini_76 ==> _v1.result.encode_ie$1 <= _v2.result.encode_ie$1; + ensures _houdini_77 ==> _v2.result.encode_ie$1 <= _v1.result.encode_ie$1; + ensures _houdini_78 ==> _v1.OK ==> _v2.OK; + ensures _houdini_79 ==> _v2.OK ==> _v1.OK; + ensures _houdini_80 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + + + +implementation MS_Check__v1.encode_ie___v2.encode_ie(_v1.buf_.1: int, + _v1.bufsize_.1: int, + _v1.ie_.1: int, + _v1.ielen_.1: int, + _v1.leader_.1: int, + _v1.leader_len_.1: int, + _v2.buf_.1: int, + _v2.bufsize_.1: int, + _v2.ie_.1: int, + _v2.ielen_.1: int, + _v2.leader_.1: int, + _v2.leader_len_.1: int) + returns (_v1.result.encode_ie$1: int, _v2.result.encode_ie$1: int) +{ + var inline$_v1.encode_ie$0$havoc_stringTemp: int; + var inline$_v1.encode_ie$0$condVal: int; + var inline$_v1.encode_ie$0$buf: int; + var inline$_v1.encode_ie$0$bufsize: int; + var inline$_v1.encode_ie$0$i: int; + var inline$_v1.encode_ie$0$ie: int; + var inline$_v1.encode_ie$0$ielen: int; + var inline$_v1.encode_ie$0$leader: int; + var inline$_v1.encode_ie$0$leader_len: int; + var inline$_v1.encode_ie$0$p: int; + var inline$_v1.encode_ie$0$result.memcpy$2: int; + var inline$_v1.encode_ie$0$$result.question.3.$$static$: int; + var inline$_v1.encode_ie$0$tempBoogie0: int; + var inline$_v1.encode_ie$0$tempBoogie1: int; + var inline$_v1.encode_ie$0$tempBoogie2: int; + var inline$_v1.encode_ie$0$tempBoogie3: int; + var inline$_v1.encode_ie$0$tempBoogie4: int; + var inline$_v1.encode_ie$0$tempBoogie5: int; + var inline$_v1.encode_ie$0$tempBoogie6: int; + var inline$_v1.encode_ie$0$tempBoogie7: int; + var inline$_v1.encode_ie$0$tempBoogie8: int; + var inline$_v1.encode_ie$0$tempBoogie9: int; + var inline$_v1.encode_ie$0$tempBoogie10: int; + var inline$_v1.encode_ie$0$tempBoogie11: int; + var inline$_v1.encode_ie$0$tempBoogie12: int; + var inline$_v1.encode_ie$0$tempBoogie13: int; + var inline$_v1.encode_ie$0$tempBoogie14: int; + var inline$_v1.encode_ie$0$tempBoogie15: int; + var inline$_v1.encode_ie$0$tempBoogie16: int; + var inline$_v1.encode_ie$0$tempBoogie17: int; + var inline$_v1.encode_ie$0$tempBoogie18: int; + var inline$_v1.encode_ie$0$tempBoogie19: int; + var inline$_v1.encode_ie$0$__havoc_dummy_return: int; + var inline$_v1.encode_ie$0$buf_.1: int; + var inline$_v1.encode_ie$0$bufsize_.1: int; + var inline$_v1.encode_ie$0$ie_.1: int; + var inline$_v1.encode_ie$0$ielen_.1: int; + var inline$_v1.encode_ie$0$leader_.1: int; + var inline$_v1.encode_ie$0$leader_len_.1: int; + var inline$_v1.encode_ie$0$result.encode_ie$1: int; + var inline$_v1.encode_ie$0$_v1.OK: bool; + var inline$_v1.encode_ie$0$_v1.Mem_T.UCHAR: [int]int; + var inline$_v2.encode_ie$0$havoc_stringTemp: int; + var inline$_v2.encode_ie$0$condVal: int; + var inline$_v2.encode_ie$0$buf: int; + var inline$_v2.encode_ie$0$bufsize: int; + var inline$_v2.encode_ie$0$i: int; + var inline$_v2.encode_ie$0$ie: int; + var inline$_v2.encode_ie$0$ielen: int; + var inline$_v2.encode_ie$0$leader: int; + var inline$_v2.encode_ie$0$leader_len: int; + var inline$_v2.encode_ie$0$p: int; + var inline$_v2.encode_ie$0$result.memcpy$2: int; + var inline$_v2.encode_ie$0$$result.question.3.$$static$: int; + var inline$_v2.encode_ie$0$tempBoogie0: int; + var inline$_v2.encode_ie$0$tempBoogie1: int; + var inline$_v2.encode_ie$0$tempBoogie2: int; + var inline$_v2.encode_ie$0$tempBoogie3: int; + var inline$_v2.encode_ie$0$tempBoogie4: int; + var inline$_v2.encode_ie$0$tempBoogie5: int; + var inline$_v2.encode_ie$0$tempBoogie6: int; + var inline$_v2.encode_ie$0$tempBoogie7: int; + var inline$_v2.encode_ie$0$tempBoogie8: int; + var inline$_v2.encode_ie$0$tempBoogie9: int; + var inline$_v2.encode_ie$0$tempBoogie10: int; + var inline$_v2.encode_ie$0$tempBoogie11: int; + var inline$_v2.encode_ie$0$tempBoogie12: int; + var inline$_v2.encode_ie$0$tempBoogie13: int; + var inline$_v2.encode_ie$0$tempBoogie14: int; + var inline$_v2.encode_ie$0$tempBoogie15: int; + var inline$_v2.encode_ie$0$tempBoogie16: int; + var inline$_v2.encode_ie$0$tempBoogie17: int; + var inline$_v2.encode_ie$0$tempBoogie18: int; + var inline$_v2.encode_ie$0$tempBoogie19: int; + var inline$_v2.encode_ie$0$__havoc_dummy_return: int; + var inline$_v2.encode_ie$0$buf_.1: int; + var inline$_v2.encode_ie$0$bufsize_.1: int; + var inline$_v2.encode_ie$0$ie_.1: int; + var inline$_v2.encode_ie$0$ielen_.1: int; + var inline$_v2.encode_ie$0$leader_.1: int; + var inline$_v2.encode_ie$0$leader_len_.1: int; + var inline$_v2.encode_ie$0$result.encode_ie$1: int; + var inline$_v2.encode_ie$0$_v2.OK: bool; + var inline$_v2.encode_ie$0$_v2.Mem_T.UCHAR: [int]int; + var _v1.memcpy_1_done: bool; + var _v1.memcpy_in_1_0: int; + var _v1.memcpy_in_1_1: int; + var _v1.memcpy_in_1_2: int; + var _v1.memcpy_in_1_3: bool; + var _v1.memcpy_in_1_4: [int]int; + var _v1.memcpy_out_1_0: int; + var _v1.encode_ie_loop_label_14_head_2_done: bool; + var _v1.encode_ie_loop_label_14_head_in_2_0: int; + var _v1.encode_ie_loop_label_14_head_in_2_1: int; + var _v1.encode_ie_loop_label_14_head_in_2_2: int; + var _v1.encode_ie_loop_label_14_head_in_2_3: int; + var _v1.encode_ie_loop_label_14_head_in_2_4: int; + var _v1.encode_ie_loop_label_14_head_in_2_5: bool; + var _v1.encode_ie_loop_label_14_head_in_2_6: [int]int; + var _v1.encode_ie_loop_label_14_head_out_2_0: int; + var _v1.encode_ie_loop_label_14_head_out_2_1: int; + var _v1.encode_ie_loop_label_14_head_out_2_2: int; + var _v1.encode_ie_loop_label_14_head_out_2_3: [int]int; + var _v1.encode_ie_loop_label_14_head_out_2_4: bool; + var _v2.memcpy_3_done: bool; + var _v2.memcpy_in_3_0: int; + var _v2.memcpy_in_3_1: int; + var _v2.memcpy_in_3_2: int; + var _v2.memcpy_in_3_3: bool; + var _v2.memcpy_in_3_4: [int]int; + var _v2.memcpy_out_3_0: int; + var _v2.encode_ie_loop_label_14_head_4_done: bool; + var _v2.encode_ie_loop_label_14_head_in_4_0: int; + var _v2.encode_ie_loop_label_14_head_in_4_1: int; + var _v2.encode_ie_loop_label_14_head_in_4_2: int; + var _v2.encode_ie_loop_label_14_head_in_4_3: int; + var _v2.encode_ie_loop_label_14_head_in_4_4: int; + var _v2.encode_ie_loop_label_14_head_in_4_5: bool; + var _v2.encode_ie_loop_label_14_head_in_4_6: [int]int; + var _v2.encode_ie_loop_label_14_head_out_4_0: int; + var _v2.encode_ie_loop_label_14_head_out_4_1: int; + var _v2.encode_ie_loop_label_14_head_out_4_2: int; + var _v2.encode_ie_loop_label_14_head_out_4_3: int; + var _v2.encode_ie_loop_label_14_head_out_4_4: [int]int; + var _v2.encode_ie_loop_label_14_head_out_4_5: bool; + var store__0__v1.OK: bool; + var store__0__v1.Mem_T.UCHAR: [int]int; + var store__0__v2.OK: bool; + var store__0__v2.Mem_T.UCHAR: [int]int; + var out__v1.memcpy_out_1_0_0: int; + var out__v2.memcpy_out_3_0_0: int; + var store__1__v1.OK: bool; + var store__1__v1.Mem_T.UCHAR: [int]int; + var store__1__v2.OK: bool; + var store__1__v2.Mem_T.UCHAR: [int]int; + var out__v1.encode_ie_loop_label_14_head_out_2_0_1: int; + var out__v1.encode_ie_loop_label_14_head_out_2_1_1: int; + var out__v1.encode_ie_loop_label_14_head_out_2_2_1: int; + var out__v2.encode_ie_loop_label_14_head_out_4_0_1: int; + var out__v2.encode_ie_loop_label_14_head_out_4_1_1: int; + var out__v2.encode_ie_loop_label_14_head_out_4_2_1: int; + var out__v2.encode_ie_loop_label_14_head_out_4_3_1: int; + + START: + _v1.memcpy_1_done, _v1.encode_ie_loop_label_14_head_2_done, _v2.memcpy_3_done, _v2.encode_ie_loop_label_14_head_4_done := false, false, false, false; + goto inline$_v1.encode_ie$0$Entry; + + inline$_v1.encode_ie$0$Entry: + inline$_v1.encode_ie$0$buf_.1 := _v1.buf_.1; + inline$_v1.encode_ie$0$bufsize_.1 := _v1.bufsize_.1; + inline$_v1.encode_ie$0$ie_.1 := _v1.ie_.1; + inline$_v1.encode_ie$0$ielen_.1 := _v1.ielen_.1; + inline$_v1.encode_ie$0$leader_.1 := _v1.leader_.1; + inline$_v1.encode_ie$0$leader_len_.1 := _v1.leader_len_.1; + havoc inline$_v1.encode_ie$0$havoc_stringTemp, inline$_v1.encode_ie$0$condVal, inline$_v1.encode_ie$0$buf, inline$_v1.encode_ie$0$bufsize, inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$ie, inline$_v1.encode_ie$0$ielen, inline$_v1.encode_ie$0$leader, inline$_v1.encode_ie$0$leader_len, inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$result.memcpy$2, inline$_v1.encode_ie$0$$result.question.3.$$static$, inline$_v1.encode_ie$0$tempBoogie0, inline$_v1.encode_ie$0$tempBoogie1, inline$_v1.encode_ie$0$tempBoogie2, inline$_v1.encode_ie$0$tempBoogie3, inline$_v1.encode_ie$0$tempBoogie4, inline$_v1.encode_ie$0$tempBoogie5, inline$_v1.encode_ie$0$tempBoogie6, inline$_v1.encode_ie$0$tempBoogie7, inline$_v1.encode_ie$0$tempBoogie8, inline$_v1.encode_ie$0$tempBoogie9, inline$_v1.encode_ie$0$tempBoogie10, inline$_v1.encode_ie$0$tempBoogie11, inline$_v1.encode_ie$0$tempBoogie12, inline$_v1.encode_ie$0$tempBoogie13, inline$_v1.encode_ie$0$tempBoogie14, inline$_v1.encode_ie$0$tempBoogie15, inline$_v1.encode_ie$0$tempBoogie16, inline$_v1.encode_ie$0$tempBoogie17, inline$_v1.encode_ie$0$tempBoogie18, inline$_v1.encode_ie$0$tempBoogie19, inline$_v1.encode_ie$0$__havoc_dummy_return, inline$_v1.encode_ie$0$result.encode_ie$1; + inline$_v1.encode_ie$0$_v1.OK := _v1.OK; + inline$_v1.encode_ie$0$_v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR; + goto inline$_v1.encode_ie$0$anon0#2; + + inline$_v1.encode_ie$0$anon0#2: + inline$_v1.encode_ie$0$havoc_stringTemp := 0; + goto inline$_v1.encode_ie$0$start#2; + + inline$_v1.encode_ie$0$start#2: + assume _v2.INT_LT(inline$_v1.encode_ie$0$buf_.1, _v1.alloc); + assume _v2.INT_LT(inline$_v1.encode_ie$0$ie_.1, _v1.alloc); + assume _v2.INT_LT(inline$_v1.encode_ie$0$leader_.1, _v1.alloc); + inline$_v1.encode_ie$0$buf := 0; + assume _v2.INT_GEQ(inline$_v1.encode_ie$0$buf_.1, 0); + inline$_v1.encode_ie$0$bufsize := 0; + inline$_v1.encode_ie$0$i := 0; + inline$_v1.encode_ie$0$ie := 0; + assume _v2.INT_GEQ(inline$_v1.encode_ie$0$ie_.1, 0); + inline$_v1.encode_ie$0$ielen := 0; + inline$_v1.encode_ie$0$leader := 0; + assume _v2.INT_GEQ(inline$_v1.encode_ie$0$leader_.1, 0); + inline$_v1.encode_ie$0$leader_len := 0; + inline$_v1.encode_ie$0$p := 0; + inline$_v1.encode_ie$0$result.encode_ie$1 := 0; + inline$_v1.encode_ie$0$result.memcpy$2 := 0; + inline$_v1.encode_ie$0$$result.question.3.$$static$ := 0; + inline$_v1.encode_ie$0$buf := inline$_v1.encode_ie$0$buf_.1; + inline$_v1.encode_ie$0$bufsize := inline$_v1.encode_ie$0$bufsize_.1; + inline$_v1.encode_ie$0$ie := inline$_v1.encode_ie$0$ie_.1; + inline$_v1.encode_ie$0$ielen := inline$_v1.encode_ie$0$ielen_.1; + inline$_v1.encode_ie$0$leader := inline$_v1.encode_ie$0$leader_.1; + inline$_v1.encode_ie$0$leader_len := inline$_v1.encode_ie$0$leader_len_.1; + goto inline$_v1.encode_ie$0$label_3#2; + + inline$_v1.encode_ie$0$label_3#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 9} true; + goto inline$_v1.encode_ie$0$label_4#2; + + inline$_v1.encode_ie$0$label_4#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 10} true; + goto inline$_v1.encode_ie$0$label_5#2; + + inline$_v1.encode_ie$0$label_5#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 13} true; + goto inline$_v1.encode_ie$0$label_5_true#2, inline$_v1.encode_ie$0$label_5_false#2; + + inline$_v1.encode_ie$0$label_5_false#2: + assume !_v2.INT_LT(inline$_v1.encode_ie$0$bufsize, inline$_v1.encode_ie$0$leader_len); + assume _v2.value_is(_v1.__ctobpl_const_1, inline$_v1.encode_ie$0$bufsize); + assume _v2.value_is(_v1.__ctobpl_const_2, inline$_v1.encode_ie$0$leader_len); + goto inline$_v1.encode_ie$0$label_6#2; + + inline$_v1.encode_ie$0$label_6#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 15} true; + inline$_v1.encode_ie$0$p := inline$_v1.encode_ie$0$buf; + assume _v2.value_is(_v1.__ctobpl_const_3, inline$_v1.encode_ie$0$p); + assume _v2.value_is(_v1.__ctobpl_const_4, inline$_v1.encode_ie$0$buf); + goto inline$_v1.encode_ie$0$label_8#2; + + inline$_v1.encode_ie$0$label_8#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 16} true; + _v1.memcpy_in_1_0, _v1.memcpy_in_1_1, _v1.memcpy_in_1_2, _v1.memcpy_in_1_3, _v1.memcpy_in_1_4 := inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$leader, inline$_v1.encode_ie$0$leader_len, _v1.OK, _v1.Mem_T.UCHAR; + call inline$_v1.encode_ie$0$result.memcpy$2 := _v1.memcpy(inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$leader, inline$_v1.encode_ie$0$leader_len); + _v1.memcpy_1_done := true; + _v1.memcpy_out_1_0 := inline$_v1.encode_ie$0$result.memcpy$2; + assume _v2.value_is(_v1.__ctobpl_const_5, inline$_v1.encode_ie$0$p); + assume _v2.value_is(_v1.__ctobpl_const_6, inline$_v1.encode_ie$0$leader); + assume _v2.value_is(_v1.__ctobpl_const_7, inline$_v1.encode_ie$0$leader_len); + assume _v2.value_is(_v1.__ctobpl_const_8, inline$_v1.encode_ie$0$p); + assume _v2.value_is(_v1.__ctobpl_const_9, inline$_v1.encode_ie$0$leader); + assume _v2.value_is(_v1.__ctobpl_const_10, inline$_v1.encode_ie$0$leader_len); + goto inline$_v1.encode_ie$0$label_11#2; + + inline$_v1.encode_ie$0$label_11#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 17} true; + havoc inline$_v1.encode_ie$0$tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(inline$_v1.encode_ie$0$bufsize, inline$_v1.encode_ie$0$leader_len, 1, inline$_v1.encode_ie$0$tempBoogie0); + inline$_v1.encode_ie$0$bufsize := inline$_v1.encode_ie$0$tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_11, inline$_v1.encode_ie$0$bufsize); + assume _v2.value_is(_v1.__ctobpl_const_12, inline$_v1.encode_ie$0$leader_len); + goto inline$_v1.encode_ie$0$label_12#2; + + inline$_v1.encode_ie$0$label_12#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 18} true; + inline$_v1.encode_ie$0$tempBoogie0 := _v2.INT_PLUS(inline$_v1.encode_ie$0$p, 1, inline$_v1.encode_ie$0$leader_len); + inline$_v1.encode_ie$0$p := inline$_v1.encode_ie$0$tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_13, inline$_v1.encode_ie$0$p); + assume _v2.value_is(_v1.__ctobpl_const_14, inline$_v1.encode_ie$0$leader_len); + goto inline$_v1.encode_ie$0$label_13#2; + + inline$_v1.encode_ie$0$label_13#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + inline$_v1.encode_ie$0$i := 0; + assume _v2.value_is(_v1.__ctobpl_const_15, inline$_v1.encode_ie$0$i); + goto inline$_v1.encode_ie$0$label_14#2; + + inline$_v1.encode_ie$0$label_14#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + goto inline$_v1.encode_ie$0$label_14_head#2; + + inline$_v1.encode_ie$0$label_14_head#2: + _v1.encode_ie_loop_label_14_head_in_2_0, _v1.encode_ie_loop_label_14_head_in_2_1, _v1.encode_ie_loop_label_14_head_in_2_2, _v1.encode_ie_loop_label_14_head_in_2_3, _v1.encode_ie_loop_label_14_head_in_2_4, _v1.encode_ie_loop_label_14_head_in_2_5, _v1.encode_ie_loop_label_14_head_in_2_6 := inline$_v1.encode_ie$0$bufsize, inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$ielen, inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$tempBoogie0, _v1.OK, _v1.Mem_T.UCHAR; + call inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$tempBoogie0 := _v1.encode_ie_loop_label_14_head(inline$_v1.encode_ie$0$bufsize, inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$ielen, inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$tempBoogie0); + _v1.encode_ie_loop_label_14_head_2_done := true; + _v1.encode_ie_loop_label_14_head_out_2_0, _v1.encode_ie_loop_label_14_head_out_2_1, _v1.encode_ie_loop_label_14_head_out_2_2, _v1.encode_ie_loop_label_14_head_out_2_3, _v1.encode_ie_loop_label_14_head_out_2_4 := inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$tempBoogie0, _v1.Mem_T.UCHAR, _v1.OK; + goto inline$_v1.encode_ie$0$label_14_head_last#2; + + inline$_v1.encode_ie$0$label_14_head_last#2: + goto inline$_v1.encode_ie$0$label_14_true#2, inline$_v1.encode_ie$0$label_14_false#2; + + inline$_v1.encode_ie$0$label_14_false#2: + assume !_v2.INT_LT(inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, inline$_v1.encode_ie$0$i); + assume _v2.value_is(_v1.__ctobpl_const_17, inline$_v1.encode_ie$0$ielen); + goto inline$_v1.encode_ie$0$label_15#2; + + inline$_v1.encode_ie$0$label_14_true#2: + assume _v2.INT_LT(inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, inline$_v1.encode_ie$0$i); + assume _v2.value_is(_v1.__ctobpl_const_17, inline$_v1.encode_ie$0$ielen); + goto inline$_v1.encode_ie$0$label_16#2; + + inline$_v1.encode_ie$0$label_16#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + goto inline$_v1.encode_ie$0$label_16_true#2, inline$_v1.encode_ie$0$label_16_false#2; + + inline$_v1.encode_ie$0$label_16_false#2: + assume !_v2.INT_LT(2, inline$_v1.encode_ie$0$bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, inline$_v1.encode_ie$0$bufsize); + goto inline$_v1.encode_ie$0$label_15#2; + + inline$_v1.encode_ie$0$label_15#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + goto inline$_v1.encode_ie$0$label_15_true#2, inline$_v1.encode_ie$0$label_15_false#2; + + inline$_v1.encode_ie$0$label_15_false#2: + assume !_v2.INT_EQ(inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$ielen); + assume _v2.value_is(_v1.__ctobpl_const_18, inline$_v1.encode_ie$0$i); + assume _v2.value_is(_v1.__ctobpl_const_19, inline$_v1.encode_ie$0$ielen); + goto inline$_v1.encode_ie$0$label_21#2; + + inline$_v1.encode_ie$0$label_21#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + inline$_v1.encode_ie$0$$result.question.3.$$static$ := 0; + assume _v2.value_is(_v1.__ctobpl_const_27, inline$_v1.encode_ie$0$$result.question.3.$$static$); + goto inline$_v1.encode_ie$0$label_23#2; + + inline$_v1.encode_ie$0$label_15_true#2: + assume _v2.INT_EQ(inline$_v1.encode_ie$0$i, inline$_v1.encode_ie$0$ielen); + assume _v2.value_is(_v1.__ctobpl_const_18, inline$_v1.encode_ie$0$i); + assume _v2.value_is(_v1.__ctobpl_const_19, inline$_v1.encode_ie$0$ielen); + goto inline$_v1.encode_ie$0$label_22#2; + + inline$_v1.encode_ie$0$label_22#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + havoc inline$_v1.encode_ie$0$$result.question.3.$$static$; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(inline$_v1.encode_ie$0$p, inline$_v1.encode_ie$0$buf, 1, inline$_v1.encode_ie$0$$result.question.3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_28, inline$_v1.encode_ie$0$$result.question.3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_29, inline$_v1.encode_ie$0$p); + assume _v2.value_is(_v1.__ctobpl_const_30, inline$_v1.encode_ie$0$buf); + goto inline$_v1.encode_ie$0$label_23#2; + + inline$_v1.encode_ie$0$label_23#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 38} true; + inline$_v1.encode_ie$0$result.encode_ie$1 := inline$_v1.encode_ie$0$$result.question.3.$$static$; + assume _v2.value_is(_v1.__ctobpl_const_31, inline$_v1.encode_ie$0$$result.question.3.$$static$); + goto inline$_v1.encode_ie$0$label_1#2; + + inline$_v1.encode_ie$0$label_16_true#2: + assume _v2.INT_LT(2, inline$_v1.encode_ie$0$bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, inline$_v1.encode_ie$0$bufsize); + goto inline$_v1.encode_ie$0$label_17#2; + + inline$_v1.encode_ie$0$label_17#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(inline$_v1.encode_ie$0$p, 0); + _v1.OK := _v1.OK && _v2.Res_VALID_REGION(inline$_v1.encode_ie$0$p) == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[inline$_v1.encode_ie$0$p := 120]; + assume _v2.value_is(_v1.__ctobpl_const_21, inline$_v1.encode_ie$0$p); + assume _v2.value_is(_v1.__ctobpl_const_22, _v1.Mem_T.UCHAR[inline$_v1.encode_ie$0$p]); + goto inline$_v1.encode_ie$0$label_18#2; + + inline$_v1.encode_ie$0$label_18#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(inline$_v1.encode_ie$0$p, 1, 1), 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(inline$_v1.encode_ie$0$p, 1, 1)) == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v1.encode_ie$0$p, 1, 1) := 120]; + assume _v2.value_is(_v1.__ctobpl_const_23, inline$_v1.encode_ie$0$p); + assume _v2.value_is(_v1.__ctobpl_const_24, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v1.encode_ie$0$p, 1, 1)]); + goto inline$_v1.encode_ie$0$label_19#2; + + inline$_v1.encode_ie$0$label_19#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 33} true; + inline$_v1.encode_ie$0$tempBoogie0 := _v2.INT_PLUS(inline$_v1.encode_ie$0$p, 1, 2); + inline$_v1.encode_ie$0$p := inline$_v1.encode_ie$0$tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_25, inline$_v1.encode_ie$0$p); + goto inline$_v1.encode_ie$0$label_20#2; + + inline$_v1.encode_ie$0$label_20#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + assume _v2.value_is(_v1.__ctobpl_const_26, inline$_v1.encode_ie$0$i); + inline$_v1.encode_ie$0$i := _v2.INT_PLUS(inline$_v1.encode_ie$0$i, 1, 1); + goto inline$_v1.encode_ie$0$label_20_dummy#2; + + inline$_v1.encode_ie$0$label_20_dummy#2: + assume false; + goto inline$_v1.encode_ie$0$Return; + + inline$_v1.encode_ie$0$label_5_true#2: + assume _v2.INT_LT(inline$_v1.encode_ie$0$bufsize, inline$_v1.encode_ie$0$leader_len); + assume _v2.value_is(_v1.__ctobpl_const_1, inline$_v1.encode_ie$0$bufsize); + assume _v2.value_is(_v1.__ctobpl_const_2, inline$_v1.encode_ie$0$leader_len); + goto inline$_v1.encode_ie$0$label_7#2; + + inline$_v1.encode_ie$0$label_7#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 14} true; + inline$_v1.encode_ie$0$result.encode_ie$1 := 0; + goto inline$_v1.encode_ie$0$label_1#2; + + inline$_v1.encode_ie$0$label_1#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 39} true; + goto inline$_v1.encode_ie$0$Return; + + inline$_v1.encode_ie$0$Return: + assume true; + _v1.result.encode_ie$1 := inline$_v1.encode_ie$0$result.encode_ie$1; + goto START$1; + + START$1: + goto inline$_v2.encode_ie$0$Entry; + + inline$_v2.encode_ie$0$Entry: + inline$_v2.encode_ie$0$buf_.1 := _v2.buf_.1; + inline$_v2.encode_ie$0$bufsize_.1 := _v2.bufsize_.1; + inline$_v2.encode_ie$0$ie_.1 := _v2.ie_.1; + inline$_v2.encode_ie$0$ielen_.1 := _v2.ielen_.1; + inline$_v2.encode_ie$0$leader_.1 := _v2.leader_.1; + inline$_v2.encode_ie$0$leader_len_.1 := _v2.leader_len_.1; + havoc inline$_v2.encode_ie$0$havoc_stringTemp, inline$_v2.encode_ie$0$condVal, inline$_v2.encode_ie$0$buf, inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$ie, inline$_v2.encode_ie$0$ielen, inline$_v2.encode_ie$0$leader, inline$_v2.encode_ie$0$leader_len, inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$result.memcpy$2, inline$_v2.encode_ie$0$$result.question.3.$$static$, inline$_v2.encode_ie$0$tempBoogie0, inline$_v2.encode_ie$0$tempBoogie1, inline$_v2.encode_ie$0$tempBoogie2, inline$_v2.encode_ie$0$tempBoogie3, inline$_v2.encode_ie$0$tempBoogie4, inline$_v2.encode_ie$0$tempBoogie5, inline$_v2.encode_ie$0$tempBoogie6, inline$_v2.encode_ie$0$tempBoogie7, inline$_v2.encode_ie$0$tempBoogie8, inline$_v2.encode_ie$0$tempBoogie9, inline$_v2.encode_ie$0$tempBoogie10, inline$_v2.encode_ie$0$tempBoogie11, inline$_v2.encode_ie$0$tempBoogie12, inline$_v2.encode_ie$0$tempBoogie13, inline$_v2.encode_ie$0$tempBoogie14, inline$_v2.encode_ie$0$tempBoogie15, inline$_v2.encode_ie$0$tempBoogie16, inline$_v2.encode_ie$0$tempBoogie17, inline$_v2.encode_ie$0$tempBoogie18, inline$_v2.encode_ie$0$tempBoogie19, inline$_v2.encode_ie$0$__havoc_dummy_return, inline$_v2.encode_ie$0$result.encode_ie$1; + inline$_v2.encode_ie$0$_v2.OK := _v2.OK; + inline$_v2.encode_ie$0$_v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR; + goto inline$_v2.encode_ie$0$anon0#2; + + inline$_v2.encode_ie$0$anon0#2: + inline$_v2.encode_ie$0$havoc_stringTemp := 0; + goto inline$_v2.encode_ie$0$start#2; + + inline$_v2.encode_ie$0$start#2: + assume _v2.INT_LT(inline$_v2.encode_ie$0$buf_.1, _v2.alloc); + assume _v2.INT_LT(inline$_v2.encode_ie$0$ie_.1, _v2.alloc); + assume _v2.INT_LT(inline$_v2.encode_ie$0$leader_.1, _v2.alloc); + inline$_v2.encode_ie$0$buf := 0; + assume _v2.INT_GEQ(inline$_v2.encode_ie$0$buf_.1, 0); + inline$_v2.encode_ie$0$bufsize := 0; + inline$_v2.encode_ie$0$i := 0; + inline$_v2.encode_ie$0$ie := 0; + assume _v2.INT_GEQ(inline$_v2.encode_ie$0$ie_.1, 0); + inline$_v2.encode_ie$0$ielen := 0; + inline$_v2.encode_ie$0$leader := 0; + assume _v2.INT_GEQ(inline$_v2.encode_ie$0$leader_.1, 0); + inline$_v2.encode_ie$0$leader_len := 0; + inline$_v2.encode_ie$0$p := 0; + inline$_v2.encode_ie$0$result.encode_ie$1 := 0; + inline$_v2.encode_ie$0$result.memcpy$2 := 0; + inline$_v2.encode_ie$0$$result.question.3.$$static$ := 0; + inline$_v2.encode_ie$0$buf := inline$_v2.encode_ie$0$buf_.1; + inline$_v2.encode_ie$0$bufsize := inline$_v2.encode_ie$0$bufsize_.1; + inline$_v2.encode_ie$0$ie := inline$_v2.encode_ie$0$ie_.1; + inline$_v2.encode_ie$0$ielen := inline$_v2.encode_ie$0$ielen_.1; + inline$_v2.encode_ie$0$leader := inline$_v2.encode_ie$0$leader_.1; + inline$_v2.encode_ie$0$leader_len := inline$_v2.encode_ie$0$leader_len_.1; + goto inline$_v2.encode_ie$0$label_3#2; + + inline$_v2.encode_ie$0$label_3#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 9} true; + goto inline$_v2.encode_ie$0$label_4#2; + + inline$_v2.encode_ie$0$label_4#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 10} true; + goto inline$_v2.encode_ie$0$label_5#2; + + inline$_v2.encode_ie$0$label_5#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 13} true; + goto inline$_v2.encode_ie$0$label_5_true#2, inline$_v2.encode_ie$0$label_5_false#2; + + inline$_v2.encode_ie$0$label_5_false#2: + assume !_v2.INT_LT(inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$leader_len); + assume _v2.value_is(_v2.__ctobpl_const_1, inline$_v2.encode_ie$0$bufsize); + assume _v2.value_is(_v2.__ctobpl_const_2, inline$_v2.encode_ie$0$leader_len); + goto inline$_v2.encode_ie$0$label_6#2; + + inline$_v2.encode_ie$0$label_6#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 15} true; + inline$_v2.encode_ie$0$p := inline$_v2.encode_ie$0$buf; + assume _v2.value_is(_v2.__ctobpl_const_3, inline$_v2.encode_ie$0$p); + assume _v2.value_is(_v2.__ctobpl_const_4, inline$_v2.encode_ie$0$buf); + goto inline$_v2.encode_ie$0$label_8#2; + + inline$_v2.encode_ie$0$label_8#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 16} true; + _v2.memcpy_in_3_0, _v2.memcpy_in_3_1, _v2.memcpy_in_3_2, _v2.memcpy_in_3_3, _v2.memcpy_in_3_4 := inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$leader, inline$_v2.encode_ie$0$leader_len, _v2.OK, _v2.Mem_T.UCHAR; + call inline$_v2.encode_ie$0$result.memcpy$2 := _v2.memcpy(inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$leader, inline$_v2.encode_ie$0$leader_len); + _v2.memcpy_3_done := true; + _v2.memcpy_out_3_0 := inline$_v2.encode_ie$0$result.memcpy$2; + assume _v2.value_is(_v2.__ctobpl_const_5, inline$_v2.encode_ie$0$p); + assume _v2.value_is(_v2.__ctobpl_const_6, inline$_v2.encode_ie$0$leader); + assume _v2.value_is(_v2.__ctobpl_const_7, inline$_v2.encode_ie$0$leader_len); + assume _v2.value_is(_v2.__ctobpl_const_8, inline$_v2.encode_ie$0$p); + assume _v2.value_is(_v2.__ctobpl_const_9, inline$_v2.encode_ie$0$leader); + assume _v2.value_is(_v2.__ctobpl_const_10, inline$_v2.encode_ie$0$leader_len); + goto inline$_v2.encode_ie$0$label_11#2; + + inline$_v2.encode_ie$0$label_11#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 17} true; + havoc inline$_v2.encode_ie$0$tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$leader_len, 1, inline$_v2.encode_ie$0$tempBoogie0); + inline$_v2.encode_ie$0$bufsize := inline$_v2.encode_ie$0$tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_11, inline$_v2.encode_ie$0$bufsize); + assume _v2.value_is(_v2.__ctobpl_const_12, inline$_v2.encode_ie$0$leader_len); + goto inline$_v2.encode_ie$0$label_12#2; + + inline$_v2.encode_ie$0$label_12#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 18} true; + inline$_v2.encode_ie$0$tempBoogie0 := _v2.INT_PLUS(inline$_v2.encode_ie$0$p, 1, inline$_v2.encode_ie$0$leader_len); + inline$_v2.encode_ie$0$p := inline$_v2.encode_ie$0$tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_13, inline$_v2.encode_ie$0$p); + assume _v2.value_is(_v2.__ctobpl_const_14, inline$_v2.encode_ie$0$leader_len); + goto inline$_v2.encode_ie$0$label_13#2; + + inline$_v2.encode_ie$0$label_13#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + inline$_v2.encode_ie$0$i := 0; + assume _v2.value_is(_v2.__ctobpl_const_15, inline$_v2.encode_ie$0$i); + goto inline$_v2.encode_ie$0$label_14#2; + + inline$_v2.encode_ie$0$label_14#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + goto inline$_v2.encode_ie$0$label_14_head#2; + + inline$_v2.encode_ie$0$label_14_head#2: + _v2.encode_ie_loop_label_14_head_in_4_0, _v2.encode_ie_loop_label_14_head_in_4_1, _v2.encode_ie_loop_label_14_head_in_4_2, _v2.encode_ie_loop_label_14_head_in_4_3, _v2.encode_ie_loop_label_14_head_in_4_4, _v2.encode_ie_loop_label_14_head_in_4_5, _v2.encode_ie_loop_label_14_head_in_4_6 := inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$ielen, inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$tempBoogie0, _v2.OK, _v2.Mem_T.UCHAR; + call inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$tempBoogie0 := _v2.encode_ie_loop_label_14_head(inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$ielen, inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$tempBoogie0); + _v2.encode_ie_loop_label_14_head_4_done := true; + _v2.encode_ie_loop_label_14_head_out_4_0, _v2.encode_ie_loop_label_14_head_out_4_1, _v2.encode_ie_loop_label_14_head_out_4_2, _v2.encode_ie_loop_label_14_head_out_4_3, _v2.encode_ie_loop_label_14_head_out_4_4, _v2.encode_ie_loop_label_14_head_out_4_5 := inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$tempBoogie0, _v2.Mem_T.UCHAR, _v2.OK; + goto inline$_v2.encode_ie$0$label_14_head_last#2; + + inline$_v2.encode_ie$0$label_14_head_last#2: + goto inline$_v2.encode_ie$0$label_14_true#2, inline$_v2.encode_ie$0$label_14_false#2; + + inline$_v2.encode_ie$0$label_14_false#2: + assume !_v2.INT_LT(inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, inline$_v2.encode_ie$0$i); + assume _v2.value_is(_v2.__ctobpl_const_17, inline$_v2.encode_ie$0$ielen); + goto inline$_v2.encode_ie$0$label_15#2; + + inline$_v2.encode_ie$0$label_14_true#2: + assume _v2.INT_LT(inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, inline$_v2.encode_ie$0$i); + assume _v2.value_is(_v2.__ctobpl_const_17, inline$_v2.encode_ie$0$ielen); + goto inline$_v2.encode_ie$0$label_16#2; + + inline$_v2.encode_ie$0$label_16#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + goto inline$_v2.encode_ie$0$label_16_true#2, inline$_v2.encode_ie$0$label_16_false#2; + + inline$_v2.encode_ie$0$label_16_false#2: + assume !_v2.INT_LT(2, inline$_v2.encode_ie$0$bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, inline$_v2.encode_ie$0$bufsize); + goto inline$_v2.encode_ie$0$label_15#2; + + inline$_v2.encode_ie$0$label_15#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + goto inline$_v2.encode_ie$0$label_15_true#2, inline$_v2.encode_ie$0$label_15_false#2; + + inline$_v2.encode_ie$0$label_15_false#2: + assume !_v2.INT_EQ(inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$ielen); + assume _v2.value_is(_v2.__ctobpl_const_18, inline$_v2.encode_ie$0$i); + assume _v2.value_is(_v2.__ctobpl_const_19, inline$_v2.encode_ie$0$ielen); + goto inline$_v2.encode_ie$0$label_22#2; + + inline$_v2.encode_ie$0$label_22#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + inline$_v2.encode_ie$0$$result.question.3.$$static$ := 0; + assume _v2.value_is(_v2.__ctobpl_const_28, inline$_v2.encode_ie$0$$result.question.3.$$static$); + goto inline$_v2.encode_ie$0$label_24#2; + + inline$_v2.encode_ie$0$label_15_true#2: + assume _v2.INT_EQ(inline$_v2.encode_ie$0$i, inline$_v2.encode_ie$0$ielen); + assume _v2.value_is(_v2.__ctobpl_const_18, inline$_v2.encode_ie$0$i); + assume _v2.value_is(_v2.__ctobpl_const_19, inline$_v2.encode_ie$0$ielen); + goto inline$_v2.encode_ie$0$label_23#2; + + inline$_v2.encode_ie$0$label_23#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + havoc inline$_v2.encode_ie$0$$result.question.3.$$static$; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(inline$_v2.encode_ie$0$p, inline$_v2.encode_ie$0$buf, 1, inline$_v2.encode_ie$0$$result.question.3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_29, inline$_v2.encode_ie$0$$result.question.3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_30, inline$_v2.encode_ie$0$p); + assume _v2.value_is(_v2.__ctobpl_const_31, inline$_v2.encode_ie$0$buf); + goto inline$_v2.encode_ie$0$label_24#2; + + inline$_v2.encode_ie$0$label_24#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 39} true; + inline$_v2.encode_ie$0$result.encode_ie$1 := inline$_v2.encode_ie$0$$result.question.3.$$static$; + assume _v2.value_is(_v2.__ctobpl_const_32, inline$_v2.encode_ie$0$$result.question.3.$$static$); + goto inline$_v2.encode_ie$0$label_1#2; + + inline$_v2.encode_ie$0$label_16_true#2: + assume _v2.INT_LT(2, inline$_v2.encode_ie$0$bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, inline$_v2.encode_ie$0$bufsize); + goto inline$_v2.encode_ie$0$label_17#2; + + inline$_v2.encode_ie$0$label_17#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(inline$_v2.encode_ie$0$p, 0); + _v2.OK := _v2.OK && _v2.Res_VALID_REGION(inline$_v2.encode_ie$0$p) == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[inline$_v2.encode_ie$0$p := 120]; + assume _v2.value_is(_v2.__ctobpl_const_21, inline$_v2.encode_ie$0$p); + assume _v2.value_is(_v2.__ctobpl_const_22, _v2.Mem_T.UCHAR[inline$_v2.encode_ie$0$p]); + goto inline$_v2.encode_ie$0$label_18#2; + + inline$_v2.encode_ie$0$label_18#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(inline$_v2.encode_ie$0$p, 1, 1), 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(inline$_v2.encode_ie$0$p, 1, 1)) == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v2.encode_ie$0$p, 1, 1) := 120]; + assume _v2.value_is(_v2.__ctobpl_const_23, inline$_v2.encode_ie$0$p); + assume _v2.value_is(_v2.__ctobpl_const_24, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v2.encode_ie$0$p, 1, 1)]); + goto inline$_v2.encode_ie$0$label_19#2; + + inline$_v2.encode_ie$0$label_19#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 33} true; + inline$_v2.encode_ie$0$tempBoogie0 := _v2.INT_PLUS(inline$_v2.encode_ie$0$p, 1, 2); + inline$_v2.encode_ie$0$p := inline$_v2.encode_ie$0$tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_25, inline$_v2.encode_ie$0$p); + goto inline$_v2.encode_ie$0$label_20#2; + + inline$_v2.encode_ie$0$label_20#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 34} true; + havoc inline$_v2.encode_ie$0$tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(inline$_v2.encode_ie$0$bufsize, 2, 1, inline$_v2.encode_ie$0$tempBoogie0); + inline$_v2.encode_ie$0$bufsize := inline$_v2.encode_ie$0$tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_26, inline$_v2.encode_ie$0$bufsize); + goto inline$_v2.encode_ie$0$label_21#2; + + inline$_v2.encode_ie$0$label_21#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + assume _v2.value_is(_v2.__ctobpl_const_27, inline$_v2.encode_ie$0$i); + inline$_v2.encode_ie$0$i := _v2.INT_PLUS(inline$_v2.encode_ie$0$i, 1, 1); + goto inline$_v2.encode_ie$0$label_21_dummy#2; + + inline$_v2.encode_ie$0$label_21_dummy#2: + assume false; + goto inline$_v2.encode_ie$0$Return; + + inline$_v2.encode_ie$0$label_5_true#2: + assume _v2.INT_LT(inline$_v2.encode_ie$0$bufsize, inline$_v2.encode_ie$0$leader_len); + assume _v2.value_is(_v2.__ctobpl_const_1, inline$_v2.encode_ie$0$bufsize); + assume _v2.value_is(_v2.__ctobpl_const_2, inline$_v2.encode_ie$0$leader_len); + goto inline$_v2.encode_ie$0$label_7#2; + + inline$_v2.encode_ie$0$label_7#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 14} true; + inline$_v2.encode_ie$0$result.encode_ie$1 := 0; + goto inline$_v2.encode_ie$0$label_1#2; + + inline$_v2.encode_ie$0$label_1#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 40} true; + goto inline$_v2.encode_ie$0$Return; + + inline$_v2.encode_ie$0$Return: + assume true; + _v2.result.encode_ie$1 := inline$_v2.encode_ie$0$result.encode_ie$1; + goto START$2; + + START$2: + goto MS_L_0_1; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.memcpy_1_done && _v2.memcpy_3_done; + store__0__v1.OK, store__0__v1.Mem_T.UCHAR := _v1.OK, _v1.Mem_T.UCHAR; + store__0__v2.OK, store__0__v2.Mem_T.UCHAR := _v2.OK, _v2.Mem_T.UCHAR; + _v1.OK, _v1.Mem_T.UCHAR := _v1.memcpy_in_1_3, _v1.memcpy_in_1_4; + _v2.OK, _v2.Mem_T.UCHAR := _v2.memcpy_in_3_3, _v2.memcpy_in_3_4; + call out__v1.memcpy_out_1_0_0, out__v2.memcpy_out_3_0_0 := MS_Check__v1.memcpy___v2.memcpy(_v1.memcpy_in_1_0, _v1.memcpy_in_1_1, _v1.memcpy_in_1_2, _v2.memcpy_in_3_0, _v2.memcpy_in_3_1, _v2.memcpy_in_3_2); + assume true; + assume true; + assume _v1.memcpy_out_1_0 == out__v1.memcpy_out_1_0_0 + && _v2.memcpy_out_3_0 == out__v2.memcpy_out_3_0_0; + _v1.OK, _v1.Mem_T.UCHAR := store__0__v1.OK, store__0__v1.Mem_T.UCHAR; + _v2.OK, _v2.Mem_T.UCHAR := store__0__v2.OK, store__0__v2.Mem_T.UCHAR; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.memcpy_1_done && _v2.memcpy_3_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; + + MS_L_0_1: + goto MS_L_taken_1, MS_L_not_taken_1; + + MS_L_taken_1: + assume _v1.encode_ie_loop_label_14_head_2_done + && _v2.encode_ie_loop_label_14_head_4_done; + store__1__v1.OK, store__1__v1.Mem_T.UCHAR := _v1.OK, _v1.Mem_T.UCHAR; + store__1__v2.OK, store__1__v2.Mem_T.UCHAR := _v2.OK, _v2.Mem_T.UCHAR; + _v1.OK, _v1.Mem_T.UCHAR := _v1.encode_ie_loop_label_14_head_in_2_5, _v1.encode_ie_loop_label_14_head_in_2_6; + _v2.OK, _v2.Mem_T.UCHAR := _v2.encode_ie_loop_label_14_head_in_4_5, _v2.encode_ie_loop_label_14_head_in_4_6; + call out__v1.encode_ie_loop_label_14_head_out_2_0_1, out__v1.encode_ie_loop_label_14_head_out_2_1_1, out__v1.encode_ie_loop_label_14_head_out_2_2_1, out__v2.encode_ie_loop_label_14_head_out_4_0_1, out__v2.encode_ie_loop_label_14_head_out_4_1_1, out__v2.encode_ie_loop_label_14_head_out_4_2_1, out__v2.encode_ie_loop_label_14_head_out_4_3_1 := MS_Check__v1.encode_ie_loop_label_14_head___v2.encode_ie_loop_label_14_head(_v1.encode_ie_loop_label_14_head_in_2_0, _v1.encode_ie_loop_label_14_head_in_2_1, _v1.encode_ie_loop_label_14_head_in_2_2, _v1.encode_ie_loop_label_14_head_in_2_3, _v1.encode_ie_loop_label_14_head_in_2_4, _v2.encode_ie_loop_label_14_head_in_4_0, _v2.encode_ie_loop_label_14_head_in_4_1, _v2.encode_ie_loop_label_14_head_in_4_2, _v2.encode_ie_loop_label_14_head_in_4_3, _v2.encode_ie_loop_label_14_head_in_4_4); + assume _v1.Mem_T.UCHAR == _v1.encode_ie_loop_label_14_head_out_2_3 + && (_v1.OK <==> _v1.encode_ie_loop_label_14_head_out_2_4); + assume _v2.Mem_T.UCHAR == _v2.encode_ie_loop_label_14_head_out_4_4 + && (_v2.OK <==> _v2.encode_ie_loop_label_14_head_out_4_5); + assume _v1.encode_ie_loop_label_14_head_out_2_0 + == out__v1.encode_ie_loop_label_14_head_out_2_0_1 + && _v1.encode_ie_loop_label_14_head_out_2_1 + == out__v1.encode_ie_loop_label_14_head_out_2_1_1 + && _v1.encode_ie_loop_label_14_head_out_2_2 + == out__v1.encode_ie_loop_label_14_head_out_2_2_1 + && _v2.encode_ie_loop_label_14_head_out_4_0 + == out__v2.encode_ie_loop_label_14_head_out_4_0_1 + && _v2.encode_ie_loop_label_14_head_out_4_1 + == out__v2.encode_ie_loop_label_14_head_out_4_1_1 + && _v2.encode_ie_loop_label_14_head_out_4_2 + == out__v2.encode_ie_loop_label_14_head_out_4_2_1 + && _v2.encode_ie_loop_label_14_head_out_4_3 + == out__v2.encode_ie_loop_label_14_head_out_4_3_1; + _v1.OK, _v1.Mem_T.UCHAR := store__1__v1.OK, store__1__v1.Mem_T.UCHAR; + _v2.OK, _v2.Mem_T.UCHAR := store__1__v2.OK, store__1__v2.Mem_T.UCHAR; + goto MS_L_meet_1; + + MS_L_not_taken_1: + assume !(_v1.encode_ie_loop_label_14_head_2_done + && _v2.encode_ie_loop_label_14_head_4_done); + goto MS_L_meet_1; + + MS_L_meet_1: + goto MS_L_0_0; +} + + + +function {:inline true} MS$_v1.encode_ie_loop_label_14_head$_v2.encode_ie_loop_label_14_head(_v1.in_bufsize: int, + _v1.in_i: int, + _v1.in_ielen: int, + _v1.in_p: int, + _v1.in_tempBoogie0: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.Mem_T.UCHAR_: [int]int, + _v1.OK_: bool, + _v1.out_i: int, + _v1.out_p: int, + _v1.out_tempBoogie0: int, + _v2.in_bufsize: int, + _v2.in_i: int, + _v2.in_ielen: int, + _v2.in_p: int, + _v2.in_tempBoogie0: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.Mem_T.UCHAR_: [int]int, + _v2.OK_: bool, + _v2.out_bufsize: int, + _v2.out_i: int, + _v2.out_p: int, + _v2.out_tempBoogie0: int) + : bool +{ + true +} + +const {:existential true} _houdini_115: bool; + +const {:existential true} _houdini_116: bool; + +const {:existential true} _houdini_117: bool; + +const {:existential true} _houdini_118: bool; + +const {:existential true} _houdini_119: bool; + +const {:existential true} _houdini_120: bool; + +const {:existential true} _houdini_121: bool; + +const {:existential true} _houdini_122: bool; + +const {:existential true} _houdini_123: bool; + +const {:existential true} _houdini_124: bool; + +const {:existential true} _houdini_125: bool; + +const {:existential true} _houdini_126: bool; + +const {:existential true} _houdini_127: bool; + +const {:existential true} _houdini_128: bool; + +const {:existential true} _houdini_129: bool; + +const {:existential true} _houdini_130: bool; + +const {:existential true} _houdini_131: bool; + +const {:existential true} _houdini_132: bool; + +const {:existential true} _houdini_133: bool; + +const {:existential true} _houdini_134: bool; + +const {:existential true} _houdini_135: bool; + +const {:existential true} _houdini_136: bool; + +const {:existential true} _houdini_137: bool; + +const {:existential true} _houdini_138: bool; + +const {:existential true} _houdini_139: bool; + +const {:existential true} _houdini_140: bool; + +const {:existential true} _houdini_141: bool; + +const {:existential true} _houdini_142: bool; + +const {:existential true} _houdini_143: bool; + +const {:existential true} _houdini_144: bool; + +const {:existential true} _houdini_145: bool; + +const {:existential true} _houdini_146: bool; + +const {:existential true} _houdini_147: bool; + +const {:existential true} _houdini_148: bool; + +const {:existential true} _houdini_149: bool; + +const {:existential true} _houdini_150: bool; + +const {:existential true} _houdini_151: bool; + +const {:existential true} _houdini_152: bool; + +const {:existential true} _houdini_153: bool; + +const {:existential true} _houdini_154: bool; + +const {:existential true} _houdini_155: bool; + +procedure MS_Check__v1.encode_ie_loop_label_14_head___v2.encode_ie_loop_label_14_head(_v1.in_bufsize: int, + _v1.in_i: int, + _v1.in_ielen: int, + _v1.in_p: int, + _v1.in_tempBoogie0: int, + _v2.in_bufsize: int, + _v2.in_i: int, + _v2.in_ielen: int, + _v2.in_p: int, + _v2.in_tempBoogie0: int) + returns (_v1.out_i: int, + _v1.out_p: int, + _v1.out_tempBoogie0: int, + _v2.out_bufsize: int, + _v2.out_i: int, + _v2.out_p: int, + _v2.out_tempBoogie0: int); + requires _houdini_124 ==> _v1.in_bufsize <= _v2.in_bufsize; + requires _houdini_125 ==> _v2.in_bufsize <= _v1.in_bufsize; + requires _houdini_126 ==> _v1.in_i <= _v2.in_i; + requires _houdini_127 ==> _v2.in_i <= _v1.in_i; + requires _houdini_128 ==> _v1.in_ielen <= _v2.in_ielen; + requires _houdini_129 ==> _v2.in_ielen <= _v1.in_ielen; + requires _houdini_130 ==> _v1.in_p <= _v2.in_p; + requires _houdini_131 ==> _v2.in_p <= _v1.in_p; + requires _houdini_132 ==> _v1.in_tempBoogie0 <= _v2.in_tempBoogie0; + requires _houdini_133 ==> _v2.in_tempBoogie0 <= _v1.in_tempBoogie0; + requires _houdini_134 ==> _v1.OK ==> _v2.OK; + requires _houdini_135 ==> _v2.OK ==> _v1.OK; + requires _houdini_136 ==> _v1.Mem == _v2.Mem; + requires _houdini_137 ==> _v1.alloc <= _v2.alloc; + requires _houdini_138 ==> _v2.alloc <= _v1.alloc; + requires _houdini_139 ==> _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR; + requires _houdini_140 ==> _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR; + requires _houdini_141 ==> _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR; + requires _houdini_142 ==> _v1.Mem_T.CHAR == _v2.Mem_T.CHAR; + requires _houdini_143 ==> _v1.Mem_T.INT4 == _v2.Mem_T.INT4; + requires _houdini_144 ==> _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR; + requires _houdini_145 ==> _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR; + requires _houdini_146 ==> _v1.Mem_T.PVOID == _v2.Mem_T.PVOID; + requires _houdini_147 + ==> _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry; + requires _houdini_148 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + requires _houdini_149 ==> _v1.Mem_T.VOID == _v2.Mem_T.VOID; + requires _houdini_150 + ==> _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry; + requires _houdini_151 + ==> _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry; + requires _houdini_152 ==> _v1.detChoiceCnt <= _v2.detChoiceCnt; + requires _houdini_153 ==> _v2.detChoiceCnt <= _v1.detChoiceCnt; + requires _houdini_154 ==> _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE; + requires _houdini_155 ==> _v1.Res_PROBED == _v2.Res_PROBED; + modifies _v1.Mem_T.UCHAR, _v1.OK, _v2.Mem_T.UCHAR, _v2.OK; + ensures MS$_v1.encode_ie_loop_label_14_head$_v2.encode_ie_loop_label_14_head(_v1.in_bufsize, + _v1.in_i, + _v1.in_ielen, + _v1.in_p, + _v1.in_tempBoogie0, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.Mem_T.UCHAR, + _v1.OK, + _v1.out_i, + _v1.out_p, + _v1.out_tempBoogie0, + _v2.in_bufsize, + _v2.in_i, + _v2.in_ielen, + _v2.in_p, + _v2.in_tempBoogie0, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.Mem_T.UCHAR, + _v2.OK, + _v2.out_bufsize, + _v2.out_i, + _v2.out_p, + _v2.out_tempBoogie0); + ensures _houdini_115 ==> _v1.out_i <= _v2.out_i; + ensures _houdini_116 ==> _v2.out_i <= _v1.out_i; + ensures _houdini_117 ==> _v1.out_p <= _v2.out_p; + ensures _houdini_118 ==> _v2.out_p <= _v1.out_p; + ensures _houdini_119 ==> _v1.out_tempBoogie0 <= _v2.out_tempBoogie0; + ensures _houdini_120 ==> _v2.out_tempBoogie0 <= _v1.out_tempBoogie0; + ensures _houdini_121 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + ensures _houdini_122 ==> _v1.OK ==> _v2.OK; + ensures _houdini_123 ==> _v2.OK ==> _v1.OK; + + + +implementation MS_Check__v1.encode_ie_loop_label_14_head___v2.encode_ie_loop_label_14_head(_v1.in_bufsize: int, + _v1.in_i: int, + _v1.in_ielen: int, + _v1.in_p: int, + _v1.in_tempBoogie0: int, + _v2.in_bufsize: int, + _v2.in_i: int, + _v2.in_ielen: int, + _v2.in_p: int, + _v2.in_tempBoogie0: int) + returns (_v1.out_i: int, + _v1.out_p: int, + _v1.out_tempBoogie0: int, + _v2.out_bufsize: int, + _v2.out_i: int, + _v2.out_p: int, + _v2.out_tempBoogie0: int) +{ + var inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize: int; + var inline$_v1.encode_ie_loop_label_14_head$0$in_i: int; + var inline$_v1.encode_ie_loop_label_14_head$0$in_ielen: int; + var inline$_v1.encode_ie_loop_label_14_head$0$in_p: int; + var inline$_v1.encode_ie_loop_label_14_head$0$in_tempBoogie0: int; + var inline$_v1.encode_ie_loop_label_14_head$0$out_i: int; + var inline$_v1.encode_ie_loop_label_14_head$0$out_p: int; + var inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0: int; + var inline$_v1.encode_ie_loop_label_14_head$0$_v1.Mem_T.UCHAR: [int]int; + var inline$_v1.encode_ie_loop_label_14_head$0$_v1.OK: bool; + var inline$_v2.encode_ie_loop_label_14_head$0$in_bufsize: int; + var inline$_v2.encode_ie_loop_label_14_head$0$in_i: int; + var inline$_v2.encode_ie_loop_label_14_head$0$in_ielen: int; + var inline$_v2.encode_ie_loop_label_14_head$0$in_p: int; + var inline$_v2.encode_ie_loop_label_14_head$0$in_tempBoogie0: int; + var inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize: int; + var inline$_v2.encode_ie_loop_label_14_head$0$out_i: int; + var inline$_v2.encode_ie_loop_label_14_head$0$out_p: int; + var inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0: int; + var inline$_v2.encode_ie_loop_label_14_head$0$_v2.Mem_T.UCHAR: [int]int; + var inline$_v2.encode_ie_loop_label_14_head$0$_v2.OK: bool; + var _v1.encode_ie_loop_label_14_head_1_done: bool; + var _v1.encode_ie_loop_label_14_head_in_1_0: int; + var _v1.encode_ie_loop_label_14_head_in_1_1: int; + var _v1.encode_ie_loop_label_14_head_in_1_2: int; + var _v1.encode_ie_loop_label_14_head_in_1_3: int; + var _v1.encode_ie_loop_label_14_head_in_1_4: int; + var _v1.encode_ie_loop_label_14_head_in_1_5: [int]int; + var _v1.encode_ie_loop_label_14_head_in_1_6: bool; + var _v1.encode_ie_loop_label_14_head_out_1_0: int; + var _v1.encode_ie_loop_label_14_head_out_1_1: int; + var _v1.encode_ie_loop_label_14_head_out_1_2: int; + var _v1.encode_ie_loop_label_14_head_out_1_3: [int]int; + var _v1.encode_ie_loop_label_14_head_out_1_4: bool; + var _v2.encode_ie_loop_label_14_head_2_done: bool; + var _v2.encode_ie_loop_label_14_head_in_2_0: int; + var _v2.encode_ie_loop_label_14_head_in_2_1: int; + var _v2.encode_ie_loop_label_14_head_in_2_2: int; + var _v2.encode_ie_loop_label_14_head_in_2_3: int; + var _v2.encode_ie_loop_label_14_head_in_2_4: int; + var _v2.encode_ie_loop_label_14_head_in_2_5: [int]int; + var _v2.encode_ie_loop_label_14_head_in_2_6: bool; + var _v2.encode_ie_loop_label_14_head_out_2_0: int; + var _v2.encode_ie_loop_label_14_head_out_2_1: int; + var _v2.encode_ie_loop_label_14_head_out_2_2: int; + var _v2.encode_ie_loop_label_14_head_out_2_3: int; + var _v2.encode_ie_loop_label_14_head_out_2_4: [int]int; + var _v2.encode_ie_loop_label_14_head_out_2_5: bool; + var store__0__v1.Mem_T.UCHAR: [int]int; + var store__0__v1.OK: bool; + var store__0__v2.Mem_T.UCHAR: [int]int; + var store__0__v2.OK: bool; + var out__v1.encode_ie_loop_label_14_head_out_1_0_0: int; + var out__v1.encode_ie_loop_label_14_head_out_1_1_0: int; + var out__v1.encode_ie_loop_label_14_head_out_1_2_0: int; + var out__v2.encode_ie_loop_label_14_head_out_2_0_0: int; + var out__v2.encode_ie_loop_label_14_head_out_2_1_0: int; + var out__v2.encode_ie_loop_label_14_head_out_2_2_0: int; + var out__v2.encode_ie_loop_label_14_head_out_2_3_0: int; + + START: + _v1.encode_ie_loop_label_14_head_1_done, _v2.encode_ie_loop_label_14_head_2_done := false, false; + goto inline$_v1.encode_ie_loop_label_14_head$0$Entry; + + inline$_v1.encode_ie_loop_label_14_head$0$Entry: + inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize := _v1.in_bufsize; + inline$_v1.encode_ie_loop_label_14_head$0$in_i := _v1.in_i; + inline$_v1.encode_ie_loop_label_14_head$0$in_ielen := _v1.in_ielen; + inline$_v1.encode_ie_loop_label_14_head$0$in_p := _v1.in_p; + inline$_v1.encode_ie_loop_label_14_head$0$in_tempBoogie0 := _v1.in_tempBoogie0; + havoc inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0; + inline$_v1.encode_ie_loop_label_14_head$0$_v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR; + inline$_v1.encode_ie_loop_label_14_head$0$_v1.OK := _v1.OK; + goto inline$_v1.encode_ie_loop_label_14_head$0$entry#2; + + inline$_v1.encode_ie_loop_label_14_head$0$entry#2: + inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0 := inline$_v1.encode_ie_loop_label_14_head$0$in_i, inline$_v1.encode_ie_loop_label_14_head$0$in_p, inline$_v1.encode_ie_loop_label_14_head$0$in_tempBoogie0; + goto inline$_v1.encode_ie_loop_label_14_head$0$label_14_head#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_14_head#2: + goto inline$_v1.encode_ie_loop_label_14_head$0$label_14_true#2, inline$_v1.encode_ie_loop_label_14_head$0$label_14_false#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_14_false#2: + assume !_v2.INT_LT(inline$_v1.encode_ie_loop_label_14_head$0$out_i, + inline$_v1.encode_ie_loop_label_14_head$0$in_ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, inline$_v1.encode_ie_loop_label_14_head$0$out_i); + assume _v2.value_is(_v1.__ctobpl_const_17, inline$_v1.encode_ie_loop_label_14_head$0$in_ielen); + inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0 := inline$_v1.encode_ie_loop_label_14_head$0$in_i, inline$_v1.encode_ie_loop_label_14_head$0$in_p, inline$_v1.encode_ie_loop_label_14_head$0$in_tempBoogie0; + _v1.Mem_T.UCHAR := inline$_v1.encode_ie_loop_label_14_head$0$_v1.Mem_T.UCHAR; + goto inline$_v1.encode_ie_loop_label_14_head$0$Return; + + inline$_v1.encode_ie_loop_label_14_head$0$label_14_true#2: + assume _v2.INT_LT(inline$_v1.encode_ie_loop_label_14_head$0$out_i, + inline$_v1.encode_ie_loop_label_14_head$0$in_ielen); + assume _v2.value_is(_v1.__ctobpl_const_16, inline$_v1.encode_ie_loop_label_14_head$0$out_i); + assume _v2.value_is(_v1.__ctobpl_const_17, inline$_v1.encode_ie_loop_label_14_head$0$in_ielen); + goto inline$_v1.encode_ie_loop_label_14_head$0$label_16#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_16#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + goto inline$_v1.encode_ie_loop_label_14_head$0$label_16_true#2, inline$_v1.encode_ie_loop_label_14_head$0$label_16_false#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_16_false#2: + assume !_v2.INT_LT(2, inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize); + inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0 := inline$_v1.encode_ie_loop_label_14_head$0$in_i, inline$_v1.encode_ie_loop_label_14_head$0$in_p, inline$_v1.encode_ie_loop_label_14_head$0$in_tempBoogie0; + _v1.Mem_T.UCHAR := inline$_v1.encode_ie_loop_label_14_head$0$_v1.Mem_T.UCHAR; + goto inline$_v1.encode_ie_loop_label_14_head$0$Return; + + inline$_v1.encode_ie_loop_label_14_head$0$label_16_true#2: + assume _v2.INT_LT(2, inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize); + assume _v2.value_is(_v1.__ctobpl_const_20, inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize); + goto inline$_v1.encode_ie_loop_label_14_head$0$label_17#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_17#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(inline$_v1.encode_ie_loop_label_14_head$0$out_p, 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(inline$_v1.encode_ie_loop_label_14_head$0$out_p) == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[inline$_v1.encode_ie_loop_label_14_head$0$out_p := 120]; + assume _v2.value_is(_v1.__ctobpl_const_21, inline$_v1.encode_ie_loop_label_14_head$0$out_p); + assume _v2.value_is(_v1.__ctobpl_const_22, + _v1.Mem_T.UCHAR[inline$_v1.encode_ie_loop_label_14_head$0$out_p]); + goto inline$_v1.encode_ie_loop_label_14_head$0$label_18#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_18#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(inline$_v1.encode_ie_loop_label_14_head$0$out_p, 1, 1), 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(inline$_v1.encode_ie_loop_label_14_head$0$out_p, 1, 1)) + == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v1.encode_ie_loop_label_14_head$0$out_p, 1, 1) := 120]; + assume _v2.value_is(_v1.__ctobpl_const_23, inline$_v1.encode_ie_loop_label_14_head$0$out_p); + assume _v2.value_is(_v1.__ctobpl_const_24, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v1.encode_ie_loop_label_14_head$0$out_p, 1, 1)]); + goto inline$_v1.encode_ie_loop_label_14_head$0$label_19#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_19#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 33} true; + inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0 := _v2.INT_PLUS(inline$_v1.encode_ie_loop_label_14_head$0$out_p, 1, 2); + inline$_v1.encode_ie_loop_label_14_head$0$out_p := inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0; + assume _v2.value_is(_v1.__ctobpl_const_25, inline$_v1.encode_ie_loop_label_14_head$0$out_p); + goto inline$_v1.encode_ie_loop_label_14_head$0$label_20#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_20#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 20} true; + assume _v2.value_is(_v1.__ctobpl_const_26, inline$_v1.encode_ie_loop_label_14_head$0$out_i); + inline$_v1.encode_ie_loop_label_14_head$0$out_i := _v2.INT_PLUS(inline$_v1.encode_ie_loop_label_14_head$0$out_i, 1, 1); + goto inline$_v1.encode_ie_loop_label_14_head$0$label_20_dummy#2; + + inline$_v1.encode_ie_loop_label_14_head$0$label_20_dummy#2: + _v1.encode_ie_loop_label_14_head_in_1_0, _v1.encode_ie_loop_label_14_head_in_1_1, _v1.encode_ie_loop_label_14_head_in_1_2, _v1.encode_ie_loop_label_14_head_in_1_3, _v1.encode_ie_loop_label_14_head_in_1_4, _v1.encode_ie_loop_label_14_head_in_1_5, _v1.encode_ie_loop_label_14_head_in_1_6 := inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize, inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$in_ielen, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0, _v1.Mem_T.UCHAR, _v1.OK; + call inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0 := _v1.encode_ie_loop_label_14_head(inline$_v1.encode_ie_loop_label_14_head$0$in_bufsize, inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$in_ielen, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0); + _v1.encode_ie_loop_label_14_head_1_done := true; + _v1.encode_ie_loop_label_14_head_out_1_0, _v1.encode_ie_loop_label_14_head_out_1_1, _v1.encode_ie_loop_label_14_head_out_1_2, _v1.encode_ie_loop_label_14_head_out_1_3, _v1.encode_ie_loop_label_14_head_out_1_4 := inline$_v1.encode_ie_loop_label_14_head$0$out_i, inline$_v1.encode_ie_loop_label_14_head$0$out_p, inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0, _v1.Mem_T.UCHAR, _v1.OK; + goto inline$_v1.encode_ie_loop_label_14_head$0$Return; + + inline$_v1.encode_ie_loop_label_14_head$0$Return: + assume true; + _v1.out_i := inline$_v1.encode_ie_loop_label_14_head$0$out_i; + _v1.out_p := inline$_v1.encode_ie_loop_label_14_head$0$out_p; + _v1.out_tempBoogie0 := inline$_v1.encode_ie_loop_label_14_head$0$out_tempBoogie0; + goto START$1; + + START$1: + goto inline$_v2.encode_ie_loop_label_14_head$0$Entry; + + inline$_v2.encode_ie_loop_label_14_head$0$Entry: + inline$_v2.encode_ie_loop_label_14_head$0$in_bufsize := _v2.in_bufsize; + inline$_v2.encode_ie_loop_label_14_head$0$in_i := _v2.in_i; + inline$_v2.encode_ie_loop_label_14_head$0$in_ielen := _v2.in_ielen; + inline$_v2.encode_ie_loop_label_14_head$0$in_p := _v2.in_p; + inline$_v2.encode_ie_loop_label_14_head$0$in_tempBoogie0 := _v2.in_tempBoogie0; + havoc inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0; + inline$_v2.encode_ie_loop_label_14_head$0$_v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR; + inline$_v2.encode_ie_loop_label_14_head$0$_v2.OK := _v2.OK; + goto inline$_v2.encode_ie_loop_label_14_head$0$entry#2; + + inline$_v2.encode_ie_loop_label_14_head$0$entry#2: + inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0 := inline$_v2.encode_ie_loop_label_14_head$0$in_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$in_i, inline$_v2.encode_ie_loop_label_14_head$0$in_p, inline$_v2.encode_ie_loop_label_14_head$0$in_tempBoogie0; + goto inline$_v2.encode_ie_loop_label_14_head$0$label_14_head#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_14_head#2: + goto inline$_v2.encode_ie_loop_label_14_head$0$label_14_true#2, inline$_v2.encode_ie_loop_label_14_head$0$label_14_false#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_14_false#2: + assume !_v2.INT_LT(inline$_v2.encode_ie_loop_label_14_head$0$out_i, + inline$_v2.encode_ie_loop_label_14_head$0$in_ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, inline$_v2.encode_ie_loop_label_14_head$0$out_i); + assume _v2.value_is(_v2.__ctobpl_const_17, inline$_v2.encode_ie_loop_label_14_head$0$in_ielen); + inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0 := inline$_v2.encode_ie_loop_label_14_head$0$in_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$in_i, inline$_v2.encode_ie_loop_label_14_head$0$in_p, inline$_v2.encode_ie_loop_label_14_head$0$in_tempBoogie0; + _v2.Mem_T.UCHAR := inline$_v2.encode_ie_loop_label_14_head$0$_v2.Mem_T.UCHAR; + goto inline$_v2.encode_ie_loop_label_14_head$0$Return; + + inline$_v2.encode_ie_loop_label_14_head$0$label_14_true#2: + assume _v2.INT_LT(inline$_v2.encode_ie_loop_label_14_head$0$out_i, + inline$_v2.encode_ie_loop_label_14_head$0$in_ielen); + assume _v2.value_is(_v2.__ctobpl_const_16, inline$_v2.encode_ie_loop_label_14_head$0$out_i); + assume _v2.value_is(_v2.__ctobpl_const_17, inline$_v2.encode_ie_loop_label_14_head$0$in_ielen); + goto inline$_v2.encode_ie_loop_label_14_head$0$label_16#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_16#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + goto inline$_v2.encode_ie_loop_label_14_head$0$label_16_true#2, inline$_v2.encode_ie_loop_label_14_head$0$label_16_false#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_16_false#2: + assume !_v2.INT_LT(2, inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize); + inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0 := inline$_v2.encode_ie_loop_label_14_head$0$in_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$in_i, inline$_v2.encode_ie_loop_label_14_head$0$in_p, inline$_v2.encode_ie_loop_label_14_head$0$in_tempBoogie0; + _v2.Mem_T.UCHAR := inline$_v2.encode_ie_loop_label_14_head$0$_v2.Mem_T.UCHAR; + goto inline$_v2.encode_ie_loop_label_14_head$0$Return; + + inline$_v2.encode_ie_loop_label_14_head$0$label_16_true#2: + assume _v2.INT_LT(2, inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize); + assume _v2.value_is(_v2.__ctobpl_const_20, inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize); + goto inline$_v2.encode_ie_loop_label_14_head$0$label_17#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_17#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 30} true; + assume _v2.INT_GEQ(inline$_v2.encode_ie_loop_label_14_head$0$out_p, 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(inline$_v2.encode_ie_loop_label_14_head$0$out_p) == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[inline$_v2.encode_ie_loop_label_14_head$0$out_p := 120]; + assume _v2.value_is(_v2.__ctobpl_const_21, inline$_v2.encode_ie_loop_label_14_head$0$out_p); + assume _v2.value_is(_v2.__ctobpl_const_22, + _v2.Mem_T.UCHAR[inline$_v2.encode_ie_loop_label_14_head$0$out_p]); + goto inline$_v2.encode_ie_loop_label_14_head$0$label_18#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_18#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 32} true; + assume _v2.INT_GEQ(_v2.INT_PLUS(inline$_v2.encode_ie_loop_label_14_head$0$out_p, 1, 1), 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(inline$_v2.encode_ie_loop_label_14_head$0$out_p, 1, 1)) + == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v2.encode_ie_loop_label_14_head$0$out_p, 1, 1) := 120]; + assume _v2.value_is(_v2.__ctobpl_const_23, inline$_v2.encode_ie_loop_label_14_head$0$out_p); + assume _v2.value_is(_v2.__ctobpl_const_24, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(inline$_v2.encode_ie_loop_label_14_head$0$out_p, 1, 1)]); + goto inline$_v2.encode_ie_loop_label_14_head$0$label_19#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_19#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 33} true; + inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0 := _v2.INT_PLUS(inline$_v2.encode_ie_loop_label_14_head$0$out_p, 1, 2); + inline$_v2.encode_ie_loop_label_14_head$0$out_p := inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_25, inline$_v2.encode_ie_loop_label_14_head$0$out_p); + goto inline$_v2.encode_ie_loop_label_14_head$0$label_20#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_20#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 34} true; + havoc inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0; + assume _v2.INT_MINUS_BOTH_PTR_OR_BOTH_INT(inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, 2, 1, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0); + inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize := inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0; + assume _v2.value_is(_v2.__ctobpl_const_26, inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize); + goto inline$_v2.encode_ie_loop_label_14_head$0$label_21#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_21#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 20} true; + assume _v2.value_is(_v2.__ctobpl_const_27, inline$_v2.encode_ie_loop_label_14_head$0$out_i); + inline$_v2.encode_ie_loop_label_14_head$0$out_i := _v2.INT_PLUS(inline$_v2.encode_ie_loop_label_14_head$0$out_i, 1, 1); + goto inline$_v2.encode_ie_loop_label_14_head$0$label_21_dummy#2; + + inline$_v2.encode_ie_loop_label_14_head$0$label_21_dummy#2: + _v2.encode_ie_loop_label_14_head_in_2_0, _v2.encode_ie_loop_label_14_head_in_2_1, _v2.encode_ie_loop_label_14_head_in_2_2, _v2.encode_ie_loop_label_14_head_in_2_3, _v2.encode_ie_loop_label_14_head_in_2_4, _v2.encode_ie_loop_label_14_head_in_2_5, _v2.encode_ie_loop_label_14_head_in_2_6 := inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$in_ielen, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0, _v2.Mem_T.UCHAR, _v2.OK; + call inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0 := _v2.encode_ie_loop_label_14_head(inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$in_ielen, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0); + _v2.encode_ie_loop_label_14_head_2_done := true; + _v2.encode_ie_loop_label_14_head_out_2_0, _v2.encode_ie_loop_label_14_head_out_2_1, _v2.encode_ie_loop_label_14_head_out_2_2, _v2.encode_ie_loop_label_14_head_out_2_3, _v2.encode_ie_loop_label_14_head_out_2_4, _v2.encode_ie_loop_label_14_head_out_2_5 := inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize, inline$_v2.encode_ie_loop_label_14_head$0$out_i, inline$_v2.encode_ie_loop_label_14_head$0$out_p, inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0, _v2.Mem_T.UCHAR, _v2.OK; + goto inline$_v2.encode_ie_loop_label_14_head$0$Return; + + inline$_v2.encode_ie_loop_label_14_head$0$Return: + assume true; + _v2.out_bufsize := inline$_v2.encode_ie_loop_label_14_head$0$out_bufsize; + _v2.out_i := inline$_v2.encode_ie_loop_label_14_head$0$out_i; + _v2.out_p := inline$_v2.encode_ie_loop_label_14_head$0$out_p; + _v2.out_tempBoogie0 := inline$_v2.encode_ie_loop_label_14_head$0$out_tempBoogie0; + goto START$2; + + START$2: + goto MS_L_0_0; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.encode_ie_loop_label_14_head_1_done + && _v2.encode_ie_loop_label_14_head_2_done; + store__0__v1.Mem_T.UCHAR, store__0__v1.OK := _v1.Mem_T.UCHAR, _v1.OK; + store__0__v2.Mem_T.UCHAR, store__0__v2.OK := _v2.Mem_T.UCHAR, _v2.OK; + _v1.Mem_T.UCHAR, _v1.OK := _v1.encode_ie_loop_label_14_head_in_1_5, _v1.encode_ie_loop_label_14_head_in_1_6; + _v2.Mem_T.UCHAR, _v2.OK := _v2.encode_ie_loop_label_14_head_in_2_5, _v2.encode_ie_loop_label_14_head_in_2_6; + call out__v1.encode_ie_loop_label_14_head_out_1_0_0, out__v1.encode_ie_loop_label_14_head_out_1_1_0, out__v1.encode_ie_loop_label_14_head_out_1_2_0, out__v2.encode_ie_loop_label_14_head_out_2_0_0, out__v2.encode_ie_loop_label_14_head_out_2_1_0, out__v2.encode_ie_loop_label_14_head_out_2_2_0, out__v2.encode_ie_loop_label_14_head_out_2_3_0 := MS_Check__v1.encode_ie_loop_label_14_head___v2.encode_ie_loop_label_14_head(_v1.encode_ie_loop_label_14_head_in_1_0, _v1.encode_ie_loop_label_14_head_in_1_1, _v1.encode_ie_loop_label_14_head_in_1_2, _v1.encode_ie_loop_label_14_head_in_1_3, _v1.encode_ie_loop_label_14_head_in_1_4, _v2.encode_ie_loop_label_14_head_in_2_0, _v2.encode_ie_loop_label_14_head_in_2_1, _v2.encode_ie_loop_label_14_head_in_2_2, _v2.encode_ie_loop_label_14_head_in_2_3, _v2.encode_ie_loop_label_14_head_in_2_4); + assume _v1.Mem_T.UCHAR == _v1.encode_ie_loop_label_14_head_out_1_3 + && (_v1.OK <==> _v1.encode_ie_loop_label_14_head_out_1_4); + assume _v2.Mem_T.UCHAR == _v2.encode_ie_loop_label_14_head_out_2_4 + && (_v2.OK <==> _v2.encode_ie_loop_label_14_head_out_2_5); + assume _v1.encode_ie_loop_label_14_head_out_1_0 + == out__v1.encode_ie_loop_label_14_head_out_1_0_0 + && _v1.encode_ie_loop_label_14_head_out_1_1 + == out__v1.encode_ie_loop_label_14_head_out_1_1_0 + && _v1.encode_ie_loop_label_14_head_out_1_2 + == out__v1.encode_ie_loop_label_14_head_out_1_2_0 + && _v2.encode_ie_loop_label_14_head_out_2_0 + == out__v2.encode_ie_loop_label_14_head_out_2_0_0 + && _v2.encode_ie_loop_label_14_head_out_2_1 + == out__v2.encode_ie_loop_label_14_head_out_2_1_0 + && _v2.encode_ie_loop_label_14_head_out_2_2 + == out__v2.encode_ie_loop_label_14_head_out_2_2_0 + && _v2.encode_ie_loop_label_14_head_out_2_3 + == out__v2.encode_ie_loop_label_14_head_out_2_3_0; + _v1.Mem_T.UCHAR, _v1.OK := store__0__v1.Mem_T.UCHAR, store__0__v1.OK; + _v2.Mem_T.UCHAR, _v2.OK := store__0__v2.Mem_T.UCHAR, store__0__v2.OK; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.encode_ie_loop_label_14_head_1_done + && _v2.encode_ie_loop_label_14_head_2_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; +} + + + +function {:inline true} MS$_v1.giwscan_cb$_v2.giwscan_cb(_v1.se_.1: int, + _v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.alloc_: int, + _v1.OK_: bool, + _v1.Mem_T.UCHAR_: [int]int, + _v1.result.giwscan_cb$1: int, + _v2.se_.1: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.alloc_: int, + _v2.OK_: bool, + _v2.Mem_T.UCHAR_: [int]int, + _v2.result.giwscan_cb$1: int) + : bool +{ + true +} + +const {:existential true} _houdini_156: bool; + +const {:existential true} _houdini_157: bool; + +const {:existential true} _houdini_158: bool; + +const {:existential true} _houdini_159: bool; + +const {:existential true} _houdini_160: bool; + +const {:existential true} _houdini_161: bool; + +const {:existential true} _houdini_162: bool; + +const {:existential true} _houdini_163: bool; + +const {:existential true} _houdini_164: bool; + +const {:existential true} _houdini_165: bool; + +const {:existential true} _houdini_166: bool; + +const {:existential true} _houdini_167: bool; + +const {:existential true} _houdini_168: bool; + +const {:existential true} _houdini_169: bool; + +const {:existential true} _houdini_170: bool; + +const {:existential true} _houdini_171: bool; + +const {:existential true} _houdini_172: bool; + +const {:existential true} _houdini_173: bool; + +const {:existential true} _houdini_174: bool; + +const {:existential true} _houdini_175: bool; + +const {:existential true} _houdini_176: bool; + +const {:existential true} _houdini_177: bool; + +const {:existential true} _houdini_178: bool; + +const {:existential true} _houdini_179: bool; + +const {:existential true} _houdini_180: bool; + +const {:existential true} _houdini_181: bool; + +const {:existential true} _houdini_182: bool; + +const {:existential true} _houdini_183: bool; + +const {:existential true} _houdini_184: bool; + +const {:existential true} _houdini_185: bool; + +const {:existential true} _houdini_186: bool; + +procedure MS_Check__v1.giwscan_cb___v2.giwscan_cb(_v1.se_.1: int, _v2.se_.1: int) + returns (_v1.result.giwscan_cb$1: int, _v2.result.giwscan_cb$1: int); + requires _houdini_163 ==> _v1.se_.1 <= _v2.se_.1; + requires _houdini_164 ==> _v2.se_.1 <= _v1.se_.1; + requires _houdini_165 ==> _v1.OK ==> _v2.OK; + requires _houdini_166 ==> _v2.OK ==> _v1.OK; + requires _houdini_167 ==> _v1.Mem == _v2.Mem; + requires _houdini_168 ==> _v1.alloc <= _v2.alloc; + requires _houdini_169 ==> _v2.alloc <= _v1.alloc; + requires _houdini_170 ==> _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR; + requires _houdini_171 ==> _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR; + requires _houdini_172 ==> _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR; + requires _houdini_173 ==> _v1.Mem_T.CHAR == _v2.Mem_T.CHAR; + requires _houdini_174 ==> _v1.Mem_T.INT4 == _v2.Mem_T.INT4; + requires _houdini_175 ==> _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR; + requires _houdini_176 ==> _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR; + requires _houdini_177 ==> _v1.Mem_T.PVOID == _v2.Mem_T.PVOID; + requires _houdini_178 + ==> _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry; + requires _houdini_179 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + requires _houdini_180 ==> _v1.Mem_T.VOID == _v2.Mem_T.VOID; + requires _houdini_181 + ==> _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry; + requires _houdini_182 + ==> _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry; + requires _houdini_183 ==> _v1.detChoiceCnt <= _v2.detChoiceCnt; + requires _houdini_184 ==> _v2.detChoiceCnt <= _v1.detChoiceCnt; + requires _houdini_185 ==> _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE; + requires _houdini_186 ==> _v1.Res_PROBED == _v2.Res_PROBED; + modifies _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR, _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + ensures MS$_v1.giwscan_cb$_v2.giwscan_cb(_v1.se_.1, + old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.alloc, + _v1.OK, + _v1.Mem_T.UCHAR, + _v1.result.giwscan_cb$1, + _v2.se_.1, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.alloc, + _v2.OK, + _v2.Mem_T.UCHAR, + _v2.result.giwscan_cb$1); + ensures _houdini_156 ==> _v1.result.giwscan_cb$1 <= _v2.result.giwscan_cb$1; + ensures _houdini_157 ==> _v2.result.giwscan_cb$1 <= _v1.result.giwscan_cb$1; + ensures _houdini_158 ==> _v1.alloc <= _v2.alloc; + ensures _houdini_159 ==> _v2.alloc <= _v1.alloc; + ensures _houdini_160 ==> _v1.OK ==> _v2.OK; + ensures _houdini_161 ==> _v2.OK ==> _v1.OK; + ensures _houdini_162 ==> _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR; + + + +implementation MS_Check__v1.giwscan_cb___v2.giwscan_cb(_v1.se_.1: int, _v2.se_.1: int) + returns (_v1.result.giwscan_cb$1: int, _v2.result.giwscan_cb$1: int) +{ + var inline$_v1.giwscan_cb$0$havoc_stringTemp: int; + var inline$_v1.giwscan_cb$0$condVal: int; + var inline$_v1.giwscan_cb$0$buf: int; + var inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$: int; + var inline$_v1.giwscan_cb$0$result.encode_ie$2: int; + var inline$_v1.giwscan_cb$0$rsn_leader: int; + var inline$_v1.giwscan_cb$0$se: int; + var inline$_v1.giwscan_cb$0$tempBoogie0: int; + var inline$_v1.giwscan_cb$0$tempBoogie1: int; + var inline$_v1.giwscan_cb$0$tempBoogie2: int; + var inline$_v1.giwscan_cb$0$tempBoogie3: int; + var inline$_v1.giwscan_cb$0$tempBoogie4: int; + var inline$_v1.giwscan_cb$0$tempBoogie5: int; + var inline$_v1.giwscan_cb$0$tempBoogie6: int; + var inline$_v1.giwscan_cb$0$tempBoogie7: int; + var inline$_v1.giwscan_cb$0$tempBoogie8: int; + var inline$_v1.giwscan_cb$0$tempBoogie9: int; + var inline$_v1.giwscan_cb$0$tempBoogie10: int; + var inline$_v1.giwscan_cb$0$tempBoogie11: int; + var inline$_v1.giwscan_cb$0$tempBoogie12: int; + var inline$_v1.giwscan_cb$0$tempBoogie13: int; + var inline$_v1.giwscan_cb$0$tempBoogie14: int; + var inline$_v1.giwscan_cb$0$tempBoogie15: int; + var inline$_v1.giwscan_cb$0$tempBoogie16: int; + var inline$_v1.giwscan_cb$0$tempBoogie17: int; + var inline$_v1.giwscan_cb$0$tempBoogie18: int; + var inline$_v1.giwscan_cb$0$tempBoogie19: int; + var inline$_v1.giwscan_cb$0$__havoc_dummy_return: int; + var inline$_v1.giwscan_cb$0$se_.1: int; + var inline$_v1.giwscan_cb$0$result.giwscan_cb$1: int; + var inline$_v1.giwscan_cb$0$_v1.alloc: int; + var inline$_v1.giwscan_cb$0$_v1.OK: bool; + var inline$_v1.giwscan_cb$0$_v1.Mem_T.UCHAR: [int]int; + var inline$_v2.giwscan_cb$0$havoc_stringTemp: int; + var inline$_v2.giwscan_cb$0$condVal: int; + var inline$_v2.giwscan_cb$0$buf: int; + var inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$: int; + var inline$_v2.giwscan_cb$0$result.encode_ie$2: int; + var inline$_v2.giwscan_cb$0$rsn_leader: int; + var inline$_v2.giwscan_cb$0$se: int; + var inline$_v2.giwscan_cb$0$tempBoogie0: int; + var inline$_v2.giwscan_cb$0$tempBoogie1: int; + var inline$_v2.giwscan_cb$0$tempBoogie2: int; + var inline$_v2.giwscan_cb$0$tempBoogie3: int; + var inline$_v2.giwscan_cb$0$tempBoogie4: int; + var inline$_v2.giwscan_cb$0$tempBoogie5: int; + var inline$_v2.giwscan_cb$0$tempBoogie6: int; + var inline$_v2.giwscan_cb$0$tempBoogie7: int; + var inline$_v2.giwscan_cb$0$tempBoogie8: int; + var inline$_v2.giwscan_cb$0$tempBoogie9: int; + var inline$_v2.giwscan_cb$0$tempBoogie10: int; + var inline$_v2.giwscan_cb$0$tempBoogie11: int; + var inline$_v2.giwscan_cb$0$tempBoogie12: int; + var inline$_v2.giwscan_cb$0$tempBoogie13: int; + var inline$_v2.giwscan_cb$0$tempBoogie14: int; + var inline$_v2.giwscan_cb$0$tempBoogie15: int; + var inline$_v2.giwscan_cb$0$tempBoogie16: int; + var inline$_v2.giwscan_cb$0$tempBoogie17: int; + var inline$_v2.giwscan_cb$0$tempBoogie18: int; + var inline$_v2.giwscan_cb$0$tempBoogie19: int; + var inline$_v2.giwscan_cb$0$__havoc_dummy_return: int; + var inline$_v2.giwscan_cb$0$se_.1: int; + var inline$_v2.giwscan_cb$0$result.giwscan_cb$1: int; + var inline$_v2.giwscan_cb$0$_v2.alloc: int; + var inline$_v2.giwscan_cb$0$_v2.OK: bool; + var inline$_v2.giwscan_cb$0$_v2.Mem_T.UCHAR: [int]int; + var _v1.__HAVOC_det_malloc_1_done: bool; + var _v1.__HAVOC_det_malloc_in_1_0: int; + var _v1.__HAVOC_det_malloc_in_1_1: int; + var _v1.__HAVOC_det_malloc_in_1_2: bool; + var _v1.__HAVOC_det_malloc_in_1_3: [int]int; + var _v1.__HAVOC_det_malloc_out_1_0: int; + var _v1.__HAVOC_det_malloc_out_1_1: int; + var _v1.__HAVOC_det_malloc_2_done: bool; + var _v1.__HAVOC_det_malloc_in_2_0: int; + var _v1.__HAVOC_det_malloc_in_2_1: int; + var _v1.__HAVOC_det_malloc_in_2_2: bool; + var _v1.__HAVOC_det_malloc_in_2_3: [int]int; + var _v1.__HAVOC_det_malloc_out_2_0: int; + var _v1.__HAVOC_det_malloc_out_2_1: int; + var _v1.encode_ie_3_done: bool; + var _v1.encode_ie_in_3_0: int; + var _v1.encode_ie_in_3_1: int; + var _v1.encode_ie_in_3_2: int; + var _v1.encode_ie_in_3_3: int; + var _v1.encode_ie_in_3_4: int; + var _v1.encode_ie_in_3_5: int; + var _v1.encode_ie_in_3_6: int; + var _v1.encode_ie_in_3_7: bool; + var _v1.encode_ie_in_3_8: [int]int; + var _v1.encode_ie_out_3_0: int; + var _v1.encode_ie_out_3_1: bool; + var _v1.encode_ie_out_3_2: [int]int; + var _v1.__HAVOC_free_4_done: bool; + var _v1.__HAVOC_free_in_4_0: int; + var _v1.__HAVOC_free_in_4_1: int; + var _v1.__HAVOC_free_in_4_2: bool; + var _v1.__HAVOC_free_in_4_3: [int]int; + var _v1.__HAVOC_free_5_done: bool; + var _v1.__HAVOC_free_in_5_0: int; + var _v1.__HAVOC_free_in_5_1: int; + var _v1.__HAVOC_free_in_5_2: bool; + var _v1.__HAVOC_free_in_5_3: [int]int; + var _v2.__HAVOC_det_malloc_6_done: bool; + var _v2.__HAVOC_det_malloc_in_6_0: int; + var _v2.__HAVOC_det_malloc_in_6_1: int; + var _v2.__HAVOC_det_malloc_in_6_2: bool; + var _v2.__HAVOC_det_malloc_in_6_3: [int]int; + var _v2.__HAVOC_det_malloc_out_6_0: int; + var _v2.__HAVOC_det_malloc_out_6_1: int; + var _v2.__HAVOC_det_malloc_7_done: bool; + var _v2.__HAVOC_det_malloc_in_7_0: int; + var _v2.__HAVOC_det_malloc_in_7_1: int; + var _v2.__HAVOC_det_malloc_in_7_2: bool; + var _v2.__HAVOC_det_malloc_in_7_3: [int]int; + var _v2.__HAVOC_det_malloc_out_7_0: int; + var _v2.__HAVOC_det_malloc_out_7_1: int; + var _v2.encode_ie_8_done: bool; + var _v2.encode_ie_in_8_0: int; + var _v2.encode_ie_in_8_1: int; + var _v2.encode_ie_in_8_2: int; + var _v2.encode_ie_in_8_3: int; + var _v2.encode_ie_in_8_4: int; + var _v2.encode_ie_in_8_5: int; + var _v2.encode_ie_in_8_6: int; + var _v2.encode_ie_in_8_7: bool; + var _v2.encode_ie_in_8_8: [int]int; + var _v2.encode_ie_out_8_0: int; + var _v2.encode_ie_out_8_1: bool; + var _v2.encode_ie_out_8_2: [int]int; + var _v2.__HAVOC_free_9_done: bool; + var _v2.__HAVOC_free_in_9_0: int; + var _v2.__HAVOC_free_in_9_1: int; + var _v2.__HAVOC_free_in_9_2: bool; + var _v2.__HAVOC_free_in_9_3: [int]int; + var _v2.__HAVOC_free_10_done: bool; + var _v2.__HAVOC_free_in_10_0: int; + var _v2.__HAVOC_free_in_10_1: int; + var _v2.__HAVOC_free_in_10_2: bool; + var _v2.__HAVOC_free_in_10_3: [int]int; + var store__0__v1.alloc: int; + var store__0__v1.OK: bool; + var store__0__v1.Mem_T.UCHAR: [int]int; + var store__0__v2.alloc: int; + var store__0__v2.OK: bool; + var store__0__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_1_0_0: int; + var out__v2.__HAVOC_det_malloc_out_6_0_0: int; + var store__1__v1.alloc: int; + var store__1__v1.OK: bool; + var store__1__v1.Mem_T.UCHAR: [int]int; + var store__1__v2.alloc: int; + var store__1__v2.OK: bool; + var store__1__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_1_0_1: int; + var out__v2.__HAVOC_det_malloc_out_7_0_1: int; + var store__2__v1.alloc: int; + var store__2__v1.OK: bool; + var store__2__v1.Mem_T.UCHAR: [int]int; + var store__2__v2.alloc: int; + var store__2__v2.OK: bool; + var store__2__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_2_0_2: int; + var out__v2.__HAVOC_det_malloc_out_6_0_2: int; + var store__3__v1.alloc: int; + var store__3__v1.OK: bool; + var store__3__v1.Mem_T.UCHAR: [int]int; + var store__3__v2.alloc: int; + var store__3__v2.OK: bool; + var store__3__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_2_0_3: int; + var out__v2.__HAVOC_det_malloc_out_7_0_3: int; + var store__4__v1.alloc: int; + var store__4__v1.OK: bool; + var store__4__v1.Mem_T.UCHAR: [int]int; + var store__4__v2.alloc: int; + var store__4__v2.OK: bool; + var store__4__v2.Mem_T.UCHAR: [int]int; + var out__v1.encode_ie_out_3_0_4: int; + var out__v2.encode_ie_out_8_0_4: int; + var store__5__v1.alloc: int; + var store__5__v1.OK: bool; + var store__5__v1.Mem_T.UCHAR: [int]int; + var store__5__v2.alloc: int; + var store__5__v2.OK: bool; + var store__5__v2.Mem_T.UCHAR: [int]int; + var store__6__v1.alloc: int; + var store__6__v1.OK: bool; + var store__6__v1.Mem_T.UCHAR: [int]int; + var store__6__v2.alloc: int; + var store__6__v2.OK: bool; + var store__6__v2.Mem_T.UCHAR: [int]int; + var store__7__v1.alloc: int; + var store__7__v1.OK: bool; + var store__7__v1.Mem_T.UCHAR: [int]int; + var store__7__v2.alloc: int; + var store__7__v2.OK: bool; + var store__7__v2.Mem_T.UCHAR: [int]int; + var store__8__v1.alloc: int; + var store__8__v1.OK: bool; + var store__8__v1.Mem_T.UCHAR: [int]int; + var store__8__v2.alloc: int; + var store__8__v2.OK: bool; + var store__8__v2.Mem_T.UCHAR: [int]int; + + START: + _v1.__HAVOC_det_malloc_1_done, _v1.__HAVOC_det_malloc_2_done, _v1.encode_ie_3_done, _v1.__HAVOC_free_4_done, _v1.__HAVOC_free_5_done, _v2.__HAVOC_det_malloc_6_done, _v2.__HAVOC_det_malloc_7_done, _v2.encode_ie_8_done, _v2.__HAVOC_free_9_done, _v2.__HAVOC_free_10_done := false, false, false, false, false, false, false, false, false, false; + goto inline$_v1.giwscan_cb$0$Entry; + + inline$_v1.giwscan_cb$0$Entry: + inline$_v1.giwscan_cb$0$se_.1 := _v1.se_.1; + havoc inline$_v1.giwscan_cb$0$havoc_stringTemp, inline$_v1.giwscan_cb$0$condVal, inline$_v1.giwscan_cb$0$buf, inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$, inline$_v1.giwscan_cb$0$result.encode_ie$2, inline$_v1.giwscan_cb$0$rsn_leader, inline$_v1.giwscan_cb$0$se, inline$_v1.giwscan_cb$0$tempBoogie0, inline$_v1.giwscan_cb$0$tempBoogie1, inline$_v1.giwscan_cb$0$tempBoogie2, inline$_v1.giwscan_cb$0$tempBoogie3, inline$_v1.giwscan_cb$0$tempBoogie4, inline$_v1.giwscan_cb$0$tempBoogie5, inline$_v1.giwscan_cb$0$tempBoogie6, inline$_v1.giwscan_cb$0$tempBoogie7, inline$_v1.giwscan_cb$0$tempBoogie8, inline$_v1.giwscan_cb$0$tempBoogie9, inline$_v1.giwscan_cb$0$tempBoogie10, inline$_v1.giwscan_cb$0$tempBoogie11, inline$_v1.giwscan_cb$0$tempBoogie12, inline$_v1.giwscan_cb$0$tempBoogie13, inline$_v1.giwscan_cb$0$tempBoogie14, inline$_v1.giwscan_cb$0$tempBoogie15, inline$_v1.giwscan_cb$0$tempBoogie16, inline$_v1.giwscan_cb$0$tempBoogie17, inline$_v1.giwscan_cb$0$tempBoogie18, inline$_v1.giwscan_cb$0$tempBoogie19, inline$_v1.giwscan_cb$0$__havoc_dummy_return, inline$_v1.giwscan_cb$0$result.giwscan_cb$1; + inline$_v1.giwscan_cb$0$_v1.alloc := _v1.alloc; + inline$_v1.giwscan_cb$0$_v1.OK := _v1.OK; + inline$_v1.giwscan_cb$0$_v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR; + goto inline$_v1.giwscan_cb$0$anon0#2; + + inline$_v1.giwscan_cb$0$anon0#2: + inline$_v1.giwscan_cb$0$havoc_stringTemp := 0; + goto inline$_v1.giwscan_cb$0$start#2; + + inline$_v1.giwscan_cb$0$start#2: + assume _v2.INT_LT(inline$_v1.giwscan_cb$0$se_.1, _v1.alloc); + _v1.__HAVOC_det_malloc_in_1_0, _v1.__HAVOC_det_malloc_in_1_1, _v1.__HAVOC_det_malloc_in_1_2, _v1.__HAVOC_det_malloc_in_1_3 := 6, _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + call inline$_v1.giwscan_cb$0$buf := _v1.__HAVOC_det_malloc(6); + _v1.__HAVOC_det_malloc_1_done := true; + _v1.__HAVOC_det_malloc_out_1_0, _v1.__HAVOC_det_malloc_out_1_1 := inline$_v1.giwscan_cb$0$buf, _v1.alloc; + inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$ := 0; + inline$_v1.giwscan_cb$0$result.encode_ie$2 := 0; + inline$_v1.giwscan_cb$0$result.giwscan_cb$1 := 0; + _v1.__HAVOC_det_malloc_in_2_0, _v1.__HAVOC_det_malloc_in_2_1, _v1.__HAVOC_det_malloc_in_2_2, _v1.__HAVOC_det_malloc_in_2_3 := 1, _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + call inline$_v1.giwscan_cb$0$rsn_leader := _v1.__HAVOC_det_malloc(1); + _v1.__HAVOC_det_malloc_2_done := true; + _v1.__HAVOC_det_malloc_out_2_0, _v1.__HAVOC_det_malloc_out_2_1 := inline$_v1.giwscan_cb$0$rsn_leader, _v1.alloc; + inline$_v1.giwscan_cb$0$se := 0; + assume _v2.INT_GEQ(inline$_v1.giwscan_cb$0$se_.1, 0); + inline$_v1.giwscan_cb$0$se := inline$_v1.giwscan_cb$0$se_.1; + goto inline$_v1.giwscan_cb$0$label_3#2; + + inline$_v1.giwscan_cb$0$label_3#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 45} true; + goto inline$_v1.giwscan_cb$0$label_4#2; + + inline$_v1.giwscan_cb$0$label_4#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 46} true; + goto inline$_v1.giwscan_cb$0$label_5#2; + + inline$_v1.giwscan_cb$0$label_5#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 50} true; + assume _v2.INT_GEQ(inline$_v1.giwscan_cb$0$se, 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)) + == 1; + assert true; + goto inline$_v1.giwscan_cb$0$label_5_true#2, inline$_v1.giwscan_cb$0$label_5_false#2; + + inline$_v1.giwscan_cb$0$label_5_false#2: + assume _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)] + == 0; + assume _v2.value_is(_v1.__ctobpl_const_32, inline$_v1.giwscan_cb$0$se); + assume _v2.value_is(_v1.__ctobpl_const_33, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)]); + goto inline$_v1.giwscan_cb$0$label_6#2; + + inline$_v1.giwscan_cb$0$label_5_true#2: + assume _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)] + != 0; + assume _v2.value_is(_v1.__ctobpl_const_32, inline$_v1.giwscan_cb$0$se); + assume _v2.value_is(_v1.__ctobpl_const_33, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)]); + goto inline$_v1.giwscan_cb$0$label_7#2; + + inline$_v1.giwscan_cb$0$label_7#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 51} true; + assume _v2.INT_GEQ(inline$_v1.giwscan_cb$0$se, 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 0)) + == 1; + assert true; + goto inline$_v1.giwscan_cb$0$label_7_true#2, inline$_v1.giwscan_cb$0$label_7_false#2; + + inline$_v1.giwscan_cb$0$label_7_false#2: + assume !_v2.INT_EQ(_v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 0)], + 200); + assume _v2.value_is(_v1.__ctobpl_const_34, inline$_v1.giwscan_cb$0$se); + assume _v2.value_is(_v1.__ctobpl_const_35, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)]); + assume _v2.value_is(_v1.__ctobpl_const_36, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 0)]); + goto inline$_v1.giwscan_cb$0$label_6#2; + + inline$_v1.giwscan_cb$0$label_7_true#2: + assume _v2.INT_EQ(_v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 0)], + 200); + assume _v2.value_is(_v1.__ctobpl_const_34, inline$_v1.giwscan_cb$0$se); + assume _v2.value_is(_v1.__ctobpl_const_35, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)]); + assume _v2.value_is(_v1.__ctobpl_const_36, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 0)]); + goto inline$_v1.giwscan_cb$0$label_8#2; + + inline$_v1.giwscan_cb$0$label_8#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 53} true; + assume _v2.INT_GEQ(inline$_v1.giwscan_cb$0$se, 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 1)) + == 1; + assert true; + inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$ := _v2.INT_PLUS(_v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 1)], + 1, + 2); + assume _v2.value_is(_v1.__ctobpl_const_37, inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_38, inline$_v1.giwscan_cb$0$se); + assume _v2.value_is(_v1.__ctobpl_const_39, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)]); + assume _v2.value_is(_v1.__ctobpl_const_40, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], + 1, + 1)]); + goto inline$_v1.giwscan_cb$0$label_9#2; + + inline$_v1.giwscan_cb$0$label_9#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 52} true; + assume _v2.INT_GEQ(inline$_v1.giwscan_cb$0$se, 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(inline$_v1.giwscan_cb$0$se, 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)) + == 1; + assert true; + _v1.encode_ie_in_3_0, _v1.encode_ie_in_3_1, _v1.encode_ie_in_3_2, _v1.encode_ie_in_3_3, _v1.encode_ie_in_3_4, _v1.encode_ie_in_3_5, _v1.encode_ie_in_3_6, _v1.encode_ie_in_3_7, _v1.encode_ie_in_3_8 := inline$_v1.giwscan_cb$0$buf, 6, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$, inline$_v1.giwscan_cb$0$rsn_leader, 1, _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + call inline$_v1.giwscan_cb$0$result.encode_ie$2 := _v1.encode_ie(inline$_v1.giwscan_cb$0$buf, 6, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)], inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$, inline$_v1.giwscan_cb$0$rsn_leader, 1); + _v1.encode_ie_3_done := true; + _v1.encode_ie_out_3_0, _v1.encode_ie_out_3_1, _v1.encode_ie_out_3_2 := inline$_v1.giwscan_cb$0$result.encode_ie$2, _v1.OK, _v1.Mem_T.UCHAR; + assume _v2.value_is(_v1.__ctobpl_const_41, inline$_v1.giwscan_cb$0$se); + assume _v2.value_is(_v1.__ctobpl_const_42, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)]); + assume _v2.value_is(_v1.__ctobpl_const_43, inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v1.__ctobpl_const_44, inline$_v1.giwscan_cb$0$se); + assume _v2.value_is(_v1.__ctobpl_const_45, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.giwscan_cb$0$se)]); + assume _v2.value_is(_v1.__ctobpl_const_46, inline$_v1.giwscan_cb$0$$encode_ie.arg.4$3.$$static$); + goto inline$_v1.giwscan_cb$0$label_6#2; + + inline$_v1.giwscan_cb$0$label_6#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 57} true; + inline$_v1.giwscan_cb$0$result.giwscan_cb$1 := 0; + goto inline$_v1.giwscan_cb$0$label_1#2; + + inline$_v1.giwscan_cb$0$label_1#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 58} true; + _v1.__HAVOC_free_in_4_0, _v1.__HAVOC_free_in_4_1, _v1.__HAVOC_free_in_4_2, _v1.__HAVOC_free_in_4_3 := inline$_v1.giwscan_cb$0$buf, _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + call _v1.__HAVOC_free(inline$_v1.giwscan_cb$0$buf); + _v1.__HAVOC_free_4_done := true; + _v1.__HAVOC_free_in_5_0, _v1.__HAVOC_free_in_5_1, _v1.__HAVOC_free_in_5_2, _v1.__HAVOC_free_in_5_3 := inline$_v1.giwscan_cb$0$rsn_leader, _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + call _v1.__HAVOC_free(inline$_v1.giwscan_cb$0$rsn_leader); + _v1.__HAVOC_free_5_done := true; + goto inline$_v1.giwscan_cb$0$Return; + + inline$_v1.giwscan_cb$0$Return: + assume true; + _v1.result.giwscan_cb$1 := inline$_v1.giwscan_cb$0$result.giwscan_cb$1; + goto START$1; + + START$1: + goto inline$_v2.giwscan_cb$0$Entry; + + inline$_v2.giwscan_cb$0$Entry: + inline$_v2.giwscan_cb$0$se_.1 := _v2.se_.1; + havoc inline$_v2.giwscan_cb$0$havoc_stringTemp, inline$_v2.giwscan_cb$0$condVal, inline$_v2.giwscan_cb$0$buf, inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$, inline$_v2.giwscan_cb$0$result.encode_ie$2, inline$_v2.giwscan_cb$0$rsn_leader, inline$_v2.giwscan_cb$0$se, inline$_v2.giwscan_cb$0$tempBoogie0, inline$_v2.giwscan_cb$0$tempBoogie1, inline$_v2.giwscan_cb$0$tempBoogie2, inline$_v2.giwscan_cb$0$tempBoogie3, inline$_v2.giwscan_cb$0$tempBoogie4, inline$_v2.giwscan_cb$0$tempBoogie5, inline$_v2.giwscan_cb$0$tempBoogie6, inline$_v2.giwscan_cb$0$tempBoogie7, inline$_v2.giwscan_cb$0$tempBoogie8, inline$_v2.giwscan_cb$0$tempBoogie9, inline$_v2.giwscan_cb$0$tempBoogie10, inline$_v2.giwscan_cb$0$tempBoogie11, inline$_v2.giwscan_cb$0$tempBoogie12, inline$_v2.giwscan_cb$0$tempBoogie13, inline$_v2.giwscan_cb$0$tempBoogie14, inline$_v2.giwscan_cb$0$tempBoogie15, inline$_v2.giwscan_cb$0$tempBoogie16, inline$_v2.giwscan_cb$0$tempBoogie17, inline$_v2.giwscan_cb$0$tempBoogie18, inline$_v2.giwscan_cb$0$tempBoogie19, inline$_v2.giwscan_cb$0$__havoc_dummy_return, inline$_v2.giwscan_cb$0$result.giwscan_cb$1; + inline$_v2.giwscan_cb$0$_v2.alloc := _v2.alloc; + inline$_v2.giwscan_cb$0$_v2.OK := _v2.OK; + inline$_v2.giwscan_cb$0$_v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR; + goto inline$_v2.giwscan_cb$0$anon0#2; + + inline$_v2.giwscan_cb$0$anon0#2: + inline$_v2.giwscan_cb$0$havoc_stringTemp := 0; + goto inline$_v2.giwscan_cb$0$start#2; + + inline$_v2.giwscan_cb$0$start#2: + assume _v2.INT_LT(inline$_v2.giwscan_cb$0$se_.1, _v2.alloc); + _v2.__HAVOC_det_malloc_in_6_0, _v2.__HAVOC_det_malloc_in_6_1, _v2.__HAVOC_det_malloc_in_6_2, _v2.__HAVOC_det_malloc_in_6_3 := 6, _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + call inline$_v2.giwscan_cb$0$buf := _v2.__HAVOC_det_malloc(6); + _v2.__HAVOC_det_malloc_6_done := true; + _v2.__HAVOC_det_malloc_out_6_0, _v2.__HAVOC_det_malloc_out_6_1 := inline$_v2.giwscan_cb$0$buf, _v2.alloc; + inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$ := 0; + inline$_v2.giwscan_cb$0$result.encode_ie$2 := 0; + inline$_v2.giwscan_cb$0$result.giwscan_cb$1 := 0; + _v2.__HAVOC_det_malloc_in_7_0, _v2.__HAVOC_det_malloc_in_7_1, _v2.__HAVOC_det_malloc_in_7_2, _v2.__HAVOC_det_malloc_in_7_3 := 1, _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + call inline$_v2.giwscan_cb$0$rsn_leader := _v2.__HAVOC_det_malloc(1); + _v2.__HAVOC_det_malloc_7_done := true; + _v2.__HAVOC_det_malloc_out_7_0, _v2.__HAVOC_det_malloc_out_7_1 := inline$_v2.giwscan_cb$0$rsn_leader, _v2.alloc; + inline$_v2.giwscan_cb$0$se := 0; + assume _v2.INT_GEQ(inline$_v2.giwscan_cb$0$se_.1, 0); + inline$_v2.giwscan_cb$0$se := inline$_v2.giwscan_cb$0$se_.1; + goto inline$_v2.giwscan_cb$0$label_3#2; + + inline$_v2.giwscan_cb$0$label_3#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 46} true; + goto inline$_v2.giwscan_cb$0$label_4#2; + + inline$_v2.giwscan_cb$0$label_4#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 47} true; + goto inline$_v2.giwscan_cb$0$label_5#2; + + inline$_v2.giwscan_cb$0$label_5#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 51} true; + assume _v2.INT_GEQ(inline$_v2.giwscan_cb$0$se, 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)) + == 1; + assert true; + goto inline$_v2.giwscan_cb$0$label_5_true#2, inline$_v2.giwscan_cb$0$label_5_false#2; + + inline$_v2.giwscan_cb$0$label_5_false#2: + assume _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)] + == 0; + assume _v2.value_is(_v2.__ctobpl_const_33, inline$_v2.giwscan_cb$0$se); + assume _v2.value_is(_v2.__ctobpl_const_34, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)]); + goto inline$_v2.giwscan_cb$0$label_6#2; + + inline$_v2.giwscan_cb$0$label_5_true#2: + assume _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)] + != 0; + assume _v2.value_is(_v2.__ctobpl_const_33, inline$_v2.giwscan_cb$0$se); + assume _v2.value_is(_v2.__ctobpl_const_34, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)]); + goto inline$_v2.giwscan_cb$0$label_7#2; + + inline$_v2.giwscan_cb$0$label_7#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 52} true; + assume _v2.INT_GEQ(inline$_v2.giwscan_cb$0$se, 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 0)) + == 1; + assert true; + goto inline$_v2.giwscan_cb$0$label_7_true#2, inline$_v2.giwscan_cb$0$label_7_false#2; + + inline$_v2.giwscan_cb$0$label_7_false#2: + assume !_v2.INT_EQ(_v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 0)], + 200); + assume _v2.value_is(_v2.__ctobpl_const_35, inline$_v2.giwscan_cb$0$se); + assume _v2.value_is(_v2.__ctobpl_const_36, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)]); + assume _v2.value_is(_v2.__ctobpl_const_37, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 0)]); + goto inline$_v2.giwscan_cb$0$label_6#2; + + inline$_v2.giwscan_cb$0$label_7_true#2: + assume _v2.INT_EQ(_v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 0)], + 200); + assume _v2.value_is(_v2.__ctobpl_const_35, inline$_v2.giwscan_cb$0$se); + assume _v2.value_is(_v2.__ctobpl_const_36, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)]); + assume _v2.value_is(_v2.__ctobpl_const_37, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 0)]); + goto inline$_v2.giwscan_cb$0$label_8#2; + + inline$_v2.giwscan_cb$0$label_8#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 54} true; + assume _v2.INT_GEQ(inline$_v2.giwscan_cb$0$se, 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 1)) + == 1; + assert true; + inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$ := _v2.INT_PLUS(_v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 1)], + 1, + 2); + assume _v2.value_is(_v2.__ctobpl_const_38, inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_39, inline$_v2.giwscan_cb$0$se); + assume _v2.value_is(_v2.__ctobpl_const_40, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)]); + assume _v2.value_is(_v2.__ctobpl_const_41, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], + 1, + 1)]); + goto inline$_v2.giwscan_cb$0$label_9#2; + + inline$_v2.giwscan_cb$0$label_9#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 53} true; + assume _v2.INT_GEQ(inline$_v2.giwscan_cb$0$se, 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(inline$_v2.giwscan_cb$0$se, 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)) + == 1; + assert true; + _v2.encode_ie_in_8_0, _v2.encode_ie_in_8_1, _v2.encode_ie_in_8_2, _v2.encode_ie_in_8_3, _v2.encode_ie_in_8_4, _v2.encode_ie_in_8_5, _v2.encode_ie_in_8_6, _v2.encode_ie_in_8_7, _v2.encode_ie_in_8_8 := inline$_v2.giwscan_cb$0$buf, 6, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$, inline$_v2.giwscan_cb$0$rsn_leader, 1, _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + call inline$_v2.giwscan_cb$0$result.encode_ie$2 := _v2.encode_ie(inline$_v2.giwscan_cb$0$buf, 6, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)], inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$, inline$_v2.giwscan_cb$0$rsn_leader, 1); + _v2.encode_ie_8_done := true; + _v2.encode_ie_out_8_0, _v2.encode_ie_out_8_1, _v2.encode_ie_out_8_2 := inline$_v2.giwscan_cb$0$result.encode_ie$2, _v2.OK, _v2.Mem_T.UCHAR; + assume _v2.value_is(_v2.__ctobpl_const_42, inline$_v2.giwscan_cb$0$se); + assume _v2.value_is(_v2.__ctobpl_const_43, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)]); + assume _v2.value_is(_v2.__ctobpl_const_44, inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$); + assume _v2.value_is(_v2.__ctobpl_const_45, inline$_v2.giwscan_cb$0$se); + assume _v2.value_is(_v2.__ctobpl_const_46, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.giwscan_cb$0$se)]); + assume _v2.value_is(_v2.__ctobpl_const_47, inline$_v2.giwscan_cb$0$$encode_ie.arg.4$3.$$static$); + goto inline$_v2.giwscan_cb$0$label_6#2; + + inline$_v2.giwscan_cb$0$label_6#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 58} true; + inline$_v2.giwscan_cb$0$result.giwscan_cb$1 := 0; + goto inline$_v2.giwscan_cb$0$label_1#2; + + inline$_v2.giwscan_cb$0$label_1#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 59} true; + _v2.__HAVOC_free_in_9_0, _v2.__HAVOC_free_in_9_1, _v2.__HAVOC_free_in_9_2, _v2.__HAVOC_free_in_9_3 := inline$_v2.giwscan_cb$0$buf, _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + call _v2.__HAVOC_free(inline$_v2.giwscan_cb$0$buf); + _v2.__HAVOC_free_9_done := true; + _v2.__HAVOC_free_in_10_0, _v2.__HAVOC_free_in_10_1, _v2.__HAVOC_free_in_10_2, _v2.__HAVOC_free_in_10_3 := inline$_v2.giwscan_cb$0$rsn_leader, _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + call _v2.__HAVOC_free(inline$_v2.giwscan_cb$0$rsn_leader); + _v2.__HAVOC_free_10_done := true; + goto inline$_v2.giwscan_cb$0$Return; + + inline$_v2.giwscan_cb$0$Return: + assume true; + _v2.result.giwscan_cb$1 := inline$_v2.giwscan_cb$0$result.giwscan_cb$1; + goto START$2; + + START$2: + goto MS_L_0_8; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_6_done; + store__0__v1.alloc, store__0__v1.OK, store__0__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__0__v2.alloc, store__0__v2.OK, store__0__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_1_1, _v1.__HAVOC_det_malloc_in_1_2, _v1.__HAVOC_det_malloc_in_1_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_6_1, _v2.__HAVOC_det_malloc_in_6_2, _v2.__HAVOC_det_malloc_in_6_3; + call out__v1.__HAVOC_det_malloc_out_1_0_0, out__v2.__HAVOC_det_malloc_out_6_0_0 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_1_0, _v2.__HAVOC_det_malloc_in_6_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_1_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_6_1; + assume _v1.__HAVOC_det_malloc_out_1_0 == out__v1.__HAVOC_det_malloc_out_1_0_0 + && _v2.__HAVOC_det_malloc_out_6_0 == out__v2.__HAVOC_det_malloc_out_6_0_0; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__0__v1.alloc, store__0__v1.OK, store__0__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__0__v2.alloc, store__0__v2.OK, store__0__v2.Mem_T.UCHAR; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_6_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; + + MS_L_0_1: + goto MS_L_taken_1, MS_L_not_taken_1; + + MS_L_taken_1: + assume _v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_7_done; + store__1__v1.alloc, store__1__v1.OK, store__1__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__1__v2.alloc, store__1__v2.OK, store__1__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_1_1, _v1.__HAVOC_det_malloc_in_1_2, _v1.__HAVOC_det_malloc_in_1_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_7_1, _v2.__HAVOC_det_malloc_in_7_2, _v2.__HAVOC_det_malloc_in_7_3; + call out__v1.__HAVOC_det_malloc_out_1_0_1, out__v2.__HAVOC_det_malloc_out_7_0_1 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_1_0, _v2.__HAVOC_det_malloc_in_7_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_1_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_7_1; + assume _v1.__HAVOC_det_malloc_out_1_0 == out__v1.__HAVOC_det_malloc_out_1_0_1 + && _v2.__HAVOC_det_malloc_out_7_0 == out__v2.__HAVOC_det_malloc_out_7_0_1; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__1__v1.alloc, store__1__v1.OK, store__1__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__1__v2.alloc, store__1__v2.OK, store__1__v2.Mem_T.UCHAR; + goto MS_L_meet_1; + + MS_L_not_taken_1: + assume !(_v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_7_done); + goto MS_L_meet_1; + + MS_L_meet_1: + goto MS_L_0_0; + + MS_L_0_2: + goto MS_L_taken_2, MS_L_not_taken_2; + + MS_L_taken_2: + assume _v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_6_done; + store__2__v1.alloc, store__2__v1.OK, store__2__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__2__v2.alloc, store__2__v2.OK, store__2__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_2_1, _v1.__HAVOC_det_malloc_in_2_2, _v1.__HAVOC_det_malloc_in_2_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_6_1, _v2.__HAVOC_det_malloc_in_6_2, _v2.__HAVOC_det_malloc_in_6_3; + call out__v1.__HAVOC_det_malloc_out_2_0_2, out__v2.__HAVOC_det_malloc_out_6_0_2 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_2_0, _v2.__HAVOC_det_malloc_in_6_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_2_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_6_1; + assume _v1.__HAVOC_det_malloc_out_2_0 == out__v1.__HAVOC_det_malloc_out_2_0_2 + && _v2.__HAVOC_det_malloc_out_6_0 == out__v2.__HAVOC_det_malloc_out_6_0_2; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__2__v1.alloc, store__2__v1.OK, store__2__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__2__v2.alloc, store__2__v2.OK, store__2__v2.Mem_T.UCHAR; + goto MS_L_meet_2; + + MS_L_not_taken_2: + assume !(_v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_6_done); + goto MS_L_meet_2; + + MS_L_meet_2: + goto MS_L_0_1; + + MS_L_0_3: + goto MS_L_taken_3, MS_L_not_taken_3; + + MS_L_taken_3: + assume _v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_7_done; + store__3__v1.alloc, store__3__v1.OK, store__3__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__3__v2.alloc, store__3__v2.OK, store__3__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_2_1, _v1.__HAVOC_det_malloc_in_2_2, _v1.__HAVOC_det_malloc_in_2_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_7_1, _v2.__HAVOC_det_malloc_in_7_2, _v2.__HAVOC_det_malloc_in_7_3; + call out__v1.__HAVOC_det_malloc_out_2_0_3, out__v2.__HAVOC_det_malloc_out_7_0_3 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_2_0, _v2.__HAVOC_det_malloc_in_7_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_2_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_7_1; + assume _v1.__HAVOC_det_malloc_out_2_0 == out__v1.__HAVOC_det_malloc_out_2_0_3 + && _v2.__HAVOC_det_malloc_out_7_0 == out__v2.__HAVOC_det_malloc_out_7_0_3; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__3__v1.alloc, store__3__v1.OK, store__3__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__3__v2.alloc, store__3__v2.OK, store__3__v2.Mem_T.UCHAR; + goto MS_L_meet_3; + + MS_L_not_taken_3: + assume !(_v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_7_done); + goto MS_L_meet_3; + + MS_L_meet_3: + goto MS_L_0_2; + + MS_L_0_4: + goto MS_L_taken_4, MS_L_not_taken_4; + + MS_L_taken_4: + assume _v1.encode_ie_3_done && _v2.encode_ie_8_done; + store__4__v1.alloc, store__4__v1.OK, store__4__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__4__v2.alloc, store__4__v2.OK, store__4__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.encode_ie_in_3_6, _v1.encode_ie_in_3_7, _v1.encode_ie_in_3_8; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.encode_ie_in_8_6, _v2.encode_ie_in_8_7, _v2.encode_ie_in_8_8; + call out__v1.encode_ie_out_3_0_4, out__v2.encode_ie_out_8_0_4 := MS_Check__v1.encode_ie___v2.encode_ie(_v1.encode_ie_in_3_0, _v1.encode_ie_in_3_1, _v1.encode_ie_in_3_2, _v1.encode_ie_in_3_3, _v1.encode_ie_in_3_4, _v1.encode_ie_in_3_5, _v2.encode_ie_in_8_0, _v2.encode_ie_in_8_1, _v2.encode_ie_in_8_2, _v2.encode_ie_in_8_3, _v2.encode_ie_in_8_4, _v2.encode_ie_in_8_5); + assume (_v1.OK <==> _v1.encode_ie_out_3_1) && _v1.Mem_T.UCHAR == _v1.encode_ie_out_3_2; + assume (_v2.OK <==> _v2.encode_ie_out_8_1) && _v2.Mem_T.UCHAR == _v2.encode_ie_out_8_2; + assume _v1.encode_ie_out_3_0 == out__v1.encode_ie_out_3_0_4 + && _v2.encode_ie_out_8_0 == out__v2.encode_ie_out_8_0_4; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__4__v1.alloc, store__4__v1.OK, store__4__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__4__v2.alloc, store__4__v2.OK, store__4__v2.Mem_T.UCHAR; + goto MS_L_meet_4; + + MS_L_not_taken_4: + assume !(_v1.encode_ie_3_done && _v2.encode_ie_8_done); + goto MS_L_meet_4; + + MS_L_meet_4: + goto MS_L_0_3; + + MS_L_0_5: + goto MS_L_taken_5, MS_L_not_taken_5; + + MS_L_taken_5: + assume _v1.__HAVOC_free_4_done && _v2.__HAVOC_free_9_done; + store__5__v1.alloc, store__5__v1.OK, store__5__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__5__v2.alloc, store__5__v2.OK, store__5__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_4_1, _v1.__HAVOC_free_in_4_2, _v1.__HAVOC_free_in_4_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_9_1, _v2.__HAVOC_free_in_9_2, _v2.__HAVOC_free_in_9_3; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_4_0, _v2.__HAVOC_free_in_9_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__5__v1.alloc, store__5__v1.OK, store__5__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__5__v2.alloc, store__5__v2.OK, store__5__v2.Mem_T.UCHAR; + goto MS_L_meet_5; + + MS_L_not_taken_5: + assume !(_v1.__HAVOC_free_4_done && _v2.__HAVOC_free_9_done); + goto MS_L_meet_5; + + MS_L_meet_5: + goto MS_L_0_4; + + MS_L_0_6: + goto MS_L_taken_6, MS_L_not_taken_6; + + MS_L_taken_6: + assume _v1.__HAVOC_free_4_done && _v2.__HAVOC_free_10_done; + store__6__v1.alloc, store__6__v1.OK, store__6__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__6__v2.alloc, store__6__v2.OK, store__6__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_4_1, _v1.__HAVOC_free_in_4_2, _v1.__HAVOC_free_in_4_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_10_1, _v2.__HAVOC_free_in_10_2, _v2.__HAVOC_free_in_10_3; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_4_0, _v2.__HAVOC_free_in_10_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__6__v1.alloc, store__6__v1.OK, store__6__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__6__v2.alloc, store__6__v2.OK, store__6__v2.Mem_T.UCHAR; + goto MS_L_meet_6; + + MS_L_not_taken_6: + assume !(_v1.__HAVOC_free_4_done && _v2.__HAVOC_free_10_done); + goto MS_L_meet_6; + + MS_L_meet_6: + goto MS_L_0_5; + + MS_L_0_7: + goto MS_L_taken_7, MS_L_not_taken_7; + + MS_L_taken_7: + assume _v1.__HAVOC_free_5_done && _v2.__HAVOC_free_9_done; + store__7__v1.alloc, store__7__v1.OK, store__7__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__7__v2.alloc, store__7__v2.OK, store__7__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_5_1, _v1.__HAVOC_free_in_5_2, _v1.__HAVOC_free_in_5_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_9_1, _v2.__HAVOC_free_in_9_2, _v2.__HAVOC_free_in_9_3; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_5_0, _v2.__HAVOC_free_in_9_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__7__v1.alloc, store__7__v1.OK, store__7__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__7__v2.alloc, store__7__v2.OK, store__7__v2.Mem_T.UCHAR; + goto MS_L_meet_7; + + MS_L_not_taken_7: + assume !(_v1.__HAVOC_free_5_done && _v2.__HAVOC_free_9_done); + goto MS_L_meet_7; + + MS_L_meet_7: + goto MS_L_0_6; + + MS_L_0_8: + goto MS_L_taken_8, MS_L_not_taken_8; + + MS_L_taken_8: + assume _v1.__HAVOC_free_5_done && _v2.__HAVOC_free_10_done; + store__8__v1.alloc, store__8__v1.OK, store__8__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + store__8__v2.alloc, store__8__v2.OK, store__8__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_5_1, _v1.__HAVOC_free_in_5_2, _v1.__HAVOC_free_in_5_3; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_10_1, _v2.__HAVOC_free_in_10_2, _v2.__HAVOC_free_in_10_3; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_5_0, _v2.__HAVOC_free_in_10_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR := store__8__v1.alloc, store__8__v1.OK, store__8__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR := store__8__v2.alloc, store__8__v2.OK, store__8__v2.Mem_T.UCHAR; + goto MS_L_meet_8; + + MS_L_not_taken_8: + assume !(_v1.__HAVOC_free_5_done && _v2.__HAVOC_free_10_done); + goto MS_L_meet_8; + + MS_L_meet_8: + goto MS_L_0_7; +} + + + +function {:inline true} MS$_v1.main$_v2.main(_v1.OK_old: bool, + _v1.Mem_old: [name][int]int, + _v1.alloc_old: int, + _v1.Mem_T.A1CHAR_old: [int]int, + _v1.Mem_T.A5UCHAR_old: [int]int, + _v1.Mem_T.A6UCHAR_old: [int]int, + _v1.Mem_T.CHAR_old: [int]int, + _v1.Mem_T.INT4_old: [int]int, + _v1.Mem_T.PCHAR_old: [int]int, + _v1.Mem_T.PUCHAR_old: [int]int, + _v1.Mem_T.PVOID_old: [int]int, + _v1.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v1.Mem_T.UCHAR_old: [int]int, + _v1.Mem_T.VOID_old: [int]int, + _v1.Mem_T.ieee80211_scan_entry_old: [int]int, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v1.detChoiceCnt_old: int, + _v1.Res_KERNEL_SOURCE_old: [int]int, + _v1.Res_PROBED_old: [int]int, + _v1.alloc_: int, + _v1.OK_: bool, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry_: [int]int, + _v1.Mem_T.UCHAR_: [int]int, + _v1.result.main$1: int, + _v2.OK_old: bool, + _v2.Mem_old: [name][int]int, + _v2.alloc_old: int, + _v2.Mem_T.A1CHAR_old: [int]int, + _v2.Mem_T.A5UCHAR_old: [int]int, + _v2.Mem_T.A6UCHAR_old: [int]int, + _v2.Mem_T.CHAR_old: [int]int, + _v2.Mem_T.INT4_old: [int]int, + _v2.Mem_T.PCHAR_old: [int]int, + _v2.Mem_T.PUCHAR_old: [int]int, + _v2.Mem_T.PVOID_old: [int]int, + _v2.Mem_T.Pieee80211_scan_entry_old: [int]int, + _v2.Mem_T.UCHAR_old: [int]int, + _v2.Mem_T.VOID_old: [int]int, + _v2.Mem_T.ieee80211_scan_entry_old: [int]int, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_old: [int]int, + _v2.detChoiceCnt_old: int, + _v2.Res_KERNEL_SOURCE_old: [int]int, + _v2.Res_PROBED_old: [int]int, + _v2.alloc_: int, + _v2.OK_: bool, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry_: [int]int, + _v2.Mem_T.UCHAR_: [int]int, + _v2.result.main$1: int) + : bool +{ + true +} + +procedure MS_Check__v1.main___v2.main() returns (_v1.result.main$1: int, _v2.result.main$1: int); + requires (_v1.OK <==> _v2.OK) + && _v1.Mem == _v2.Mem + && _v1.alloc == _v2.alloc + && _v1.Mem_T.A1CHAR == _v2.Mem_T.A1CHAR + && _v1.Mem_T.A5UCHAR == _v2.Mem_T.A5UCHAR + && _v1.Mem_T.A6UCHAR == _v2.Mem_T.A6UCHAR + && _v1.Mem_T.CHAR == _v2.Mem_T.CHAR + && _v1.Mem_T.INT4 == _v2.Mem_T.INT4 + && _v1.Mem_T.PCHAR == _v2.Mem_T.PCHAR + && _v1.Mem_T.PUCHAR == _v2.Mem_T.PUCHAR + && _v1.Mem_T.PVOID == _v2.Mem_T.PVOID + && _v1.Mem_T.Pieee80211_scan_entry == _v2.Mem_T.Pieee80211_scan_entry + && _v1.Mem_T.UCHAR == _v2.Mem_T.UCHAR + && _v1.Mem_T.VOID == _v2.Mem_T.VOID + && _v1.Mem_T.ieee80211_scan_entry == _v2.Mem_T.ieee80211_scan_entry + && _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry + == _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry + && _v1.detChoiceCnt == _v2.detChoiceCnt + && _v1.Res_KERNEL_SOURCE == _v2.Res_KERNEL_SOURCE + && _v1.Res_PROBED == _v2.Res_PROBED; + modifies _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR, _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + ensures MS$_v1.main$_v2.main(old(_v1.OK), + old(_v1.Mem), + old(_v1.alloc), + old(_v1.Mem_T.A1CHAR), + old(_v1.Mem_T.A5UCHAR), + old(_v1.Mem_T.A6UCHAR), + old(_v1.Mem_T.CHAR), + old(_v1.Mem_T.INT4), + old(_v1.Mem_T.PCHAR), + old(_v1.Mem_T.PUCHAR), + old(_v1.Mem_T.PVOID), + old(_v1.Mem_T.Pieee80211_scan_entry), + old(_v1.Mem_T.UCHAR), + old(_v1.Mem_T.VOID), + old(_v1.Mem_T.ieee80211_scan_entry), + old(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v1.detChoiceCnt), + old(_v1.Res_KERNEL_SOURCE), + old(_v1.Res_PROBED), + _v1.alloc, + _v1.OK, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, + _v1.Mem_T.UCHAR, + _v1.result.main$1, + old(_v2.OK), + old(_v2.Mem), + old(_v2.alloc), + old(_v2.Mem_T.A1CHAR), + old(_v2.Mem_T.A5UCHAR), + old(_v2.Mem_T.A6UCHAR), + old(_v2.Mem_T.CHAR), + old(_v2.Mem_T.INT4), + old(_v2.Mem_T.PCHAR), + old(_v2.Mem_T.PUCHAR), + old(_v2.Mem_T.PVOID), + old(_v2.Mem_T.Pieee80211_scan_entry), + old(_v2.Mem_T.UCHAR), + old(_v2.Mem_T.VOID), + old(_v2.Mem_T.ieee80211_scan_entry), + old(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry), + old(_v2.detChoiceCnt), + old(_v2.Res_KERNEL_SOURCE), + old(_v2.Res_PROBED), + _v2.alloc, + _v2.OK, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, + _v2.Mem_T.UCHAR, + _v2.result.main$1); + ensures _v1.OK ==> _v2.OK; + + + +implementation MS_Check__v1.main___v2.main() returns (_v1.result.main$1: int, _v2.result.main$1: int) +{ + var inline$_v1.main$0$havoc_stringTemp: int; + var inline$_v1.main$0$condVal: int; + var inline$_v1.main$0$ie: int; + var inline$_v1.main$0$result.giwscan_cb$2: int; + var inline$_v1.main$0$se: int; + var inline$_v1.main$0$tempBoogie0: int; + var inline$_v1.main$0$tempBoogie1: int; + var inline$_v1.main$0$tempBoogie2: int; + var inline$_v1.main$0$tempBoogie3: int; + var inline$_v1.main$0$tempBoogie4: int; + var inline$_v1.main$0$tempBoogie5: int; + var inline$_v1.main$0$tempBoogie6: int; + var inline$_v1.main$0$tempBoogie7: int; + var inline$_v1.main$0$tempBoogie8: int; + var inline$_v1.main$0$tempBoogie9: int; + var inline$_v1.main$0$tempBoogie10: int; + var inline$_v1.main$0$tempBoogie11: int; + var inline$_v1.main$0$tempBoogie12: int; + var inline$_v1.main$0$tempBoogie13: int; + var inline$_v1.main$0$tempBoogie14: int; + var inline$_v1.main$0$tempBoogie15: int; + var inline$_v1.main$0$tempBoogie16: int; + var inline$_v1.main$0$tempBoogie17: int; + var inline$_v1.main$0$tempBoogie18: int; + var inline$_v1.main$0$tempBoogie19: int; + var inline$_v1.main$0$__havoc_dummy_return: int; + var inline$_v1.main$0$result.main$1: int; + var inline$_v1.main$0$_v1.alloc: int; + var inline$_v1.main$0$_v1.OK: bool; + var inline$_v1.main$0$_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var inline$_v1.main$0$_v1.Mem_T.UCHAR: [int]int; + var inline$_v2.main$0$havoc_stringTemp: int; + var inline$_v2.main$0$condVal: int; + var inline$_v2.main$0$ie: int; + var inline$_v2.main$0$result.giwscan_cb$2: int; + var inline$_v2.main$0$se: int; + var inline$_v2.main$0$tempBoogie0: int; + var inline$_v2.main$0$tempBoogie1: int; + var inline$_v2.main$0$tempBoogie2: int; + var inline$_v2.main$0$tempBoogie3: int; + var inline$_v2.main$0$tempBoogie4: int; + var inline$_v2.main$0$tempBoogie5: int; + var inline$_v2.main$0$tempBoogie6: int; + var inline$_v2.main$0$tempBoogie7: int; + var inline$_v2.main$0$tempBoogie8: int; + var inline$_v2.main$0$tempBoogie9: int; + var inline$_v2.main$0$tempBoogie10: int; + var inline$_v2.main$0$tempBoogie11: int; + var inline$_v2.main$0$tempBoogie12: int; + var inline$_v2.main$0$tempBoogie13: int; + var inline$_v2.main$0$tempBoogie14: int; + var inline$_v2.main$0$tempBoogie15: int; + var inline$_v2.main$0$tempBoogie16: int; + var inline$_v2.main$0$tempBoogie17: int; + var inline$_v2.main$0$tempBoogie18: int; + var inline$_v2.main$0$tempBoogie19: int; + var inline$_v2.main$0$__havoc_dummy_return: int; + var inline$_v2.main$0$result.main$1: int; + var inline$_v2.main$0$_v2.alloc: int; + var inline$_v2.main$0$_v2.OK: bool; + var inline$_v2.main$0$_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var inline$_v2.main$0$_v2.Mem_T.UCHAR: [int]int; + var _v1.__HAVOC_det_malloc_1_done: bool; + var _v1.__HAVOC_det_malloc_in_1_0: int; + var _v1.__HAVOC_det_malloc_in_1_1: int; + var _v1.__HAVOC_det_malloc_in_1_2: bool; + var _v1.__HAVOC_det_malloc_in_1_3: [int]int; + var _v1.__HAVOC_det_malloc_in_1_4: [int]int; + var _v1.__HAVOC_det_malloc_out_1_0: int; + var _v1.__HAVOC_det_malloc_out_1_1: int; + var _v1.__HAVOC_det_malloc_2_done: bool; + var _v1.__HAVOC_det_malloc_in_2_0: int; + var _v1.__HAVOC_det_malloc_in_2_1: int; + var _v1.__HAVOC_det_malloc_in_2_2: bool; + var _v1.__HAVOC_det_malloc_in_2_3: [int]int; + var _v1.__HAVOC_det_malloc_in_2_4: [int]int; + var _v1.__HAVOC_det_malloc_out_2_0: int; + var _v1.__HAVOC_det_malloc_out_2_1: int; + var _v1.giwscan_cb_3_done: bool; + var _v1.giwscan_cb_in_3_0: int; + var _v1.giwscan_cb_in_3_1: int; + var _v1.giwscan_cb_in_3_2: bool; + var _v1.giwscan_cb_in_3_3: [int]int; + var _v1.giwscan_cb_in_3_4: [int]int; + var _v1.giwscan_cb_out_3_0: int; + var _v1.giwscan_cb_out_3_1: int; + var _v1.giwscan_cb_out_3_2: bool; + var _v1.giwscan_cb_out_3_3: [int]int; + var _v1.__HAVOC_free_4_done: bool; + var _v1.__HAVOC_free_in_4_0: int; + var _v1.__HAVOC_free_in_4_1: int; + var _v1.__HAVOC_free_in_4_2: bool; + var _v1.__HAVOC_free_in_4_3: [int]int; + var _v1.__HAVOC_free_in_4_4: [int]int; + var _v1.__HAVOC_free_5_done: bool; + var _v1.__HAVOC_free_in_5_0: int; + var _v1.__HAVOC_free_in_5_1: int; + var _v1.__HAVOC_free_in_5_2: bool; + var _v1.__HAVOC_free_in_5_3: [int]int; + var _v1.__HAVOC_free_in_5_4: [int]int; + var _v2.__HAVOC_det_malloc_6_done: bool; + var _v2.__HAVOC_det_malloc_in_6_0: int; + var _v2.__HAVOC_det_malloc_in_6_1: int; + var _v2.__HAVOC_det_malloc_in_6_2: bool; + var _v2.__HAVOC_det_malloc_in_6_3: [int]int; + var _v2.__HAVOC_det_malloc_in_6_4: [int]int; + var _v2.__HAVOC_det_malloc_out_6_0: int; + var _v2.__HAVOC_det_malloc_out_6_1: int; + var _v2.__HAVOC_det_malloc_7_done: bool; + var _v2.__HAVOC_det_malloc_in_7_0: int; + var _v2.__HAVOC_det_malloc_in_7_1: int; + var _v2.__HAVOC_det_malloc_in_7_2: bool; + var _v2.__HAVOC_det_malloc_in_7_3: [int]int; + var _v2.__HAVOC_det_malloc_in_7_4: [int]int; + var _v2.__HAVOC_det_malloc_out_7_0: int; + var _v2.__HAVOC_det_malloc_out_7_1: int; + var _v2.giwscan_cb_8_done: bool; + var _v2.giwscan_cb_in_8_0: int; + var _v2.giwscan_cb_in_8_1: int; + var _v2.giwscan_cb_in_8_2: bool; + var _v2.giwscan_cb_in_8_3: [int]int; + var _v2.giwscan_cb_in_8_4: [int]int; + var _v2.giwscan_cb_out_8_0: int; + var _v2.giwscan_cb_out_8_1: int; + var _v2.giwscan_cb_out_8_2: bool; + var _v2.giwscan_cb_out_8_3: [int]int; + var _v2.__HAVOC_free_9_done: bool; + var _v2.__HAVOC_free_in_9_0: int; + var _v2.__HAVOC_free_in_9_1: int; + var _v2.__HAVOC_free_in_9_2: bool; + var _v2.__HAVOC_free_in_9_3: [int]int; + var _v2.__HAVOC_free_in_9_4: [int]int; + var _v2.__HAVOC_free_10_done: bool; + var _v2.__HAVOC_free_in_10_0: int; + var _v2.__HAVOC_free_in_10_1: int; + var _v2.__HAVOC_free_in_10_2: bool; + var _v2.__HAVOC_free_in_10_3: [int]int; + var _v2.__HAVOC_free_in_10_4: [int]int; + var store__0__v1.alloc: int; + var store__0__v1.OK: bool; + var store__0__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__0__v1.Mem_T.UCHAR: [int]int; + var store__0__v2.alloc: int; + var store__0__v2.OK: bool; + var store__0__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__0__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_1_0_0: int; + var out__v2.__HAVOC_det_malloc_out_6_0_0: int; + var store__1__v1.alloc: int; + var store__1__v1.OK: bool; + var store__1__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__1__v1.Mem_T.UCHAR: [int]int; + var store__1__v2.alloc: int; + var store__1__v2.OK: bool; + var store__1__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__1__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_1_0_1: int; + var out__v2.__HAVOC_det_malloc_out_7_0_1: int; + var store__2__v1.alloc: int; + var store__2__v1.OK: bool; + var store__2__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__2__v1.Mem_T.UCHAR: [int]int; + var store__2__v2.alloc: int; + var store__2__v2.OK: bool; + var store__2__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__2__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_2_0_2: int; + var out__v2.__HAVOC_det_malloc_out_6_0_2: int; + var store__3__v1.alloc: int; + var store__3__v1.OK: bool; + var store__3__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__3__v1.Mem_T.UCHAR: [int]int; + var store__3__v2.alloc: int; + var store__3__v2.OK: bool; + var store__3__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__3__v2.Mem_T.UCHAR: [int]int; + var out__v1.__HAVOC_det_malloc_out_2_0_3: int; + var out__v2.__HAVOC_det_malloc_out_7_0_3: int; + var store__4__v1.alloc: int; + var store__4__v1.OK: bool; + var store__4__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__4__v1.Mem_T.UCHAR: [int]int; + var store__4__v2.alloc: int; + var store__4__v2.OK: bool; + var store__4__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__4__v2.Mem_T.UCHAR: [int]int; + var out__v1.giwscan_cb_out_3_0_4: int; + var out__v2.giwscan_cb_out_8_0_4: int; + var store__5__v1.alloc: int; + var store__5__v1.OK: bool; + var store__5__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__5__v1.Mem_T.UCHAR: [int]int; + var store__5__v2.alloc: int; + var store__5__v2.OK: bool; + var store__5__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__5__v2.Mem_T.UCHAR: [int]int; + var store__6__v1.alloc: int; + var store__6__v1.OK: bool; + var store__6__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__6__v1.Mem_T.UCHAR: [int]int; + var store__6__v2.alloc: int; + var store__6__v2.OK: bool; + var store__6__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__6__v2.Mem_T.UCHAR: [int]int; + var store__7__v1.alloc: int; + var store__7__v1.OK: bool; + var store__7__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__7__v1.Mem_T.UCHAR: [int]int; + var store__7__v2.alloc: int; + var store__7__v2.OK: bool; + var store__7__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__7__v2.Mem_T.UCHAR: [int]int; + var store__8__v1.alloc: int; + var store__8__v1.OK: bool; + var store__8__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__8__v1.Mem_T.UCHAR: [int]int; + var store__8__v2.alloc: int; + var store__8__v2.OK: bool; + var store__8__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry: [int]int; + var store__8__v2.Mem_T.UCHAR: [int]int; + + START: + _v1.__HAVOC_det_malloc_1_done, _v1.__HAVOC_det_malloc_2_done, _v1.giwscan_cb_3_done, _v1.__HAVOC_free_4_done, _v1.__HAVOC_free_5_done, _v2.__HAVOC_det_malloc_6_done, _v2.__HAVOC_det_malloc_7_done, _v2.giwscan_cb_8_done, _v2.__HAVOC_free_9_done, _v2.__HAVOC_free_10_done := false, false, false, false, false, false, false, false, false, false; + goto inline$_v1.main$0$Entry; + + inline$_v1.main$0$Entry: + havoc inline$_v1.main$0$havoc_stringTemp, inline$_v1.main$0$condVal, inline$_v1.main$0$ie, inline$_v1.main$0$result.giwscan_cb$2, inline$_v1.main$0$se, inline$_v1.main$0$tempBoogie0, inline$_v1.main$0$tempBoogie1, inline$_v1.main$0$tempBoogie2, inline$_v1.main$0$tempBoogie3, inline$_v1.main$0$tempBoogie4, inline$_v1.main$0$tempBoogie5, inline$_v1.main$0$tempBoogie6, inline$_v1.main$0$tempBoogie7, inline$_v1.main$0$tempBoogie8, inline$_v1.main$0$tempBoogie9, inline$_v1.main$0$tempBoogie10, inline$_v1.main$0$tempBoogie11, inline$_v1.main$0$tempBoogie12, inline$_v1.main$0$tempBoogie13, inline$_v1.main$0$tempBoogie14, inline$_v1.main$0$tempBoogie15, inline$_v1.main$0$tempBoogie16, inline$_v1.main$0$tempBoogie17, inline$_v1.main$0$tempBoogie18, inline$_v1.main$0$tempBoogie19, inline$_v1.main$0$__havoc_dummy_return, inline$_v1.main$0$result.main$1; + inline$_v1.main$0$_v1.alloc := _v1.alloc; + inline$_v1.main$0$_v1.OK := _v1.OK; + inline$_v1.main$0$_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry := _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry; + inline$_v1.main$0$_v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR; + goto inline$_v1.main$0$anon0#2; + + inline$_v1.main$0$anon0#2: + inline$_v1.main$0$havoc_stringTemp := 0; + goto inline$_v1.main$0$start#2; + + inline$_v1.main$0$start#2: + _v1.__HAVOC_det_malloc_in_1_0, _v1.__HAVOC_det_malloc_in_1_1, _v1.__HAVOC_det_malloc_in_1_2, _v1.__HAVOC_det_malloc_in_1_3, _v1.__HAVOC_det_malloc_in_1_4 := 5, _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + call inline$_v1.main$0$ie := _v1.__HAVOC_det_malloc(5); + _v1.__HAVOC_det_malloc_1_done := true; + _v1.__HAVOC_det_malloc_out_1_0, _v1.__HAVOC_det_malloc_out_1_1 := inline$_v1.main$0$ie, _v1.alloc; + inline$_v1.main$0$result.giwscan_cb$2 := 0; + inline$_v1.main$0$result.main$1 := 0; + _v1.__HAVOC_det_malloc_in_2_0, _v1.__HAVOC_det_malloc_in_2_1, _v1.__HAVOC_det_malloc_in_2_2, _v1.__HAVOC_det_malloc_in_2_3, _v1.__HAVOC_det_malloc_in_2_4 := 4, _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + call inline$_v1.main$0$se := _v1.__HAVOC_det_malloc(4); + _v1.__HAVOC_det_malloc_2_done := true; + _v1.__HAVOC_det_malloc_out_2_0, _v1.__HAVOC_det_malloc_out_2_1 := inline$_v1.main$0$se, _v1.alloc; + goto inline$_v1.main$0$label_3#2; + + inline$_v1.main$0$label_3#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 62} true; + goto inline$_v1.main$0$label_4#2; + + inline$_v1.main$0$label_4#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 63} true; + goto inline$_v1.main$0$label_5#2; + + inline$_v1.main$0$label_5#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 64} true; + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)) + == 1; + assert true; + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry := _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se) := inline$_v1.main$0$ie]; + assume _v2.value_is(_v1.__ctobpl_const_47, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)]); + goto inline$_v1.main$0$label_6#2; + + inline$_v1.main$0$label_6#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 65} true; + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 1, + 0)) + == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 1, + 0) := 200]; + assume _v2.value_is(_v1.__ctobpl_const_48, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)]); + assume _v2.value_is(_v1.__ctobpl_const_49, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 1, + 0)]); + goto inline$_v1.main$0$label_7#2; + + inline$_v1.main$0$label_7#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 66} true; + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 0); + _v1.OK := _v1.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 1, + 1)) + == 1; + assert true; + _v1.Mem_T.UCHAR := _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 1, + 1) := 3]; + assume _v2.value_is(_v1.__ctobpl_const_50, + _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)]); + assume _v2.value_is(_v1.__ctobpl_const_51, + _v1.Mem_T.UCHAR[_v2.INT_PLUS(_v1.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v1.main$0$se)], + 1, + 1)]); + goto inline$_v1.main$0$label_8#2; + + inline$_v1.main$0$label_8#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 68} true; + assume _v2.INT_GT(inline$_v1.main$0$se, 0); + assume _v2.INT_GT(inline$_v1.main$0$se, 0); + _v1.giwscan_cb_in_3_0, _v1.giwscan_cb_in_3_1, _v1.giwscan_cb_in_3_2, _v1.giwscan_cb_in_3_3, _v1.giwscan_cb_in_3_4 := inline$_v1.main$0$se, _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + call inline$_v1.main$0$result.giwscan_cb$2 := _v1.giwscan_cb(inline$_v1.main$0$se); + _v1.giwscan_cb_3_done := true; + _v1.giwscan_cb_out_3_0, _v1.giwscan_cb_out_3_1, _v1.giwscan_cb_out_3_2, _v1.giwscan_cb_out_3_3 := inline$_v1.main$0$result.giwscan_cb$2, _v1.alloc, _v1.OK, _v1.Mem_T.UCHAR; + goto inline$_v1.main$0$label_11#2; + + inline$_v1.main$0$label_11#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 70} true; + inline$_v1.main$0$result.main$1 := 0; + goto inline$_v1.main$0$label_1#2; + + inline$_v1.main$0$label_1#2: + _v1.OK := _v1.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\bad\interproc_bad.c"} {:sourceline 71} true; + _v1.__HAVOC_free_in_4_0, _v1.__HAVOC_free_in_4_1, _v1.__HAVOC_free_in_4_2, _v1.__HAVOC_free_in_4_3, _v1.__HAVOC_free_in_4_4 := inline$_v1.main$0$ie, _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + call _v1.__HAVOC_free(inline$_v1.main$0$ie); + _v1.__HAVOC_free_4_done := true; + _v1.__HAVOC_free_in_5_0, _v1.__HAVOC_free_in_5_1, _v1.__HAVOC_free_in_5_2, _v1.__HAVOC_free_in_5_3, _v1.__HAVOC_free_in_5_4 := inline$_v1.main$0$se, _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + call _v1.__HAVOC_free(inline$_v1.main$0$se); + _v1.__HAVOC_free_5_done := true; + goto inline$_v1.main$0$Return; + + inline$_v1.main$0$Return: + assume true; + _v1.result.main$1 := inline$_v1.main$0$result.main$1; + goto START$1; + + START$1: + goto inline$_v2.main$0$Entry; + + inline$_v2.main$0$Entry: + havoc inline$_v2.main$0$havoc_stringTemp, inline$_v2.main$0$condVal, inline$_v2.main$0$ie, inline$_v2.main$0$result.giwscan_cb$2, inline$_v2.main$0$se, inline$_v2.main$0$tempBoogie0, inline$_v2.main$0$tempBoogie1, inline$_v2.main$0$tempBoogie2, inline$_v2.main$0$tempBoogie3, inline$_v2.main$0$tempBoogie4, inline$_v2.main$0$tempBoogie5, inline$_v2.main$0$tempBoogie6, inline$_v2.main$0$tempBoogie7, inline$_v2.main$0$tempBoogie8, inline$_v2.main$0$tempBoogie9, inline$_v2.main$0$tempBoogie10, inline$_v2.main$0$tempBoogie11, inline$_v2.main$0$tempBoogie12, inline$_v2.main$0$tempBoogie13, inline$_v2.main$0$tempBoogie14, inline$_v2.main$0$tempBoogie15, inline$_v2.main$0$tempBoogie16, inline$_v2.main$0$tempBoogie17, inline$_v2.main$0$tempBoogie18, inline$_v2.main$0$tempBoogie19, inline$_v2.main$0$__havoc_dummy_return, inline$_v2.main$0$result.main$1; + inline$_v2.main$0$_v2.alloc := _v2.alloc; + inline$_v2.main$0$_v2.OK := _v2.OK; + inline$_v2.main$0$_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry := _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry; + inline$_v2.main$0$_v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR; + goto inline$_v2.main$0$anon0#2; + + inline$_v2.main$0$anon0#2: + inline$_v2.main$0$havoc_stringTemp := 0; + goto inline$_v2.main$0$start#2; + + inline$_v2.main$0$start#2: + _v2.__HAVOC_det_malloc_in_6_0, _v2.__HAVOC_det_malloc_in_6_1, _v2.__HAVOC_det_malloc_in_6_2, _v2.__HAVOC_det_malloc_in_6_3, _v2.__HAVOC_det_malloc_in_6_4 := 5, _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + call inline$_v2.main$0$ie := _v2.__HAVOC_det_malloc(5); + _v2.__HAVOC_det_malloc_6_done := true; + _v2.__HAVOC_det_malloc_out_6_0, _v2.__HAVOC_det_malloc_out_6_1 := inline$_v2.main$0$ie, _v2.alloc; + inline$_v2.main$0$result.giwscan_cb$2 := 0; + inline$_v2.main$0$result.main$1 := 0; + _v2.__HAVOC_det_malloc_in_7_0, _v2.__HAVOC_det_malloc_in_7_1, _v2.__HAVOC_det_malloc_in_7_2, _v2.__HAVOC_det_malloc_in_7_3, _v2.__HAVOC_det_malloc_in_7_4 := 4, _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + call inline$_v2.main$0$se := _v2.__HAVOC_det_malloc(4); + _v2.__HAVOC_det_malloc_7_done := true; + _v2.__HAVOC_det_malloc_out_7_0, _v2.__HAVOC_det_malloc_out_7_1 := inline$_v2.main$0$se, _v2.alloc; + goto inline$_v2.main$0$label_3#2; + + inline$_v2.main$0$label_3#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 63} true; + goto inline$_v2.main$0$label_4#2; + + inline$_v2.main$0$label_4#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 64} true; + goto inline$_v2.main$0$label_5#2; + + inline$_v2.main$0$label_5#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 65} true; + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)) + == 1; + assert true; + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry := _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se) := inline$_v2.main$0$ie]; + assume _v2.value_is(_v2.__ctobpl_const_48, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)]); + goto inline$_v2.main$0$label_6#2; + + inline$_v2.main$0$label_6#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 66} true; + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 1, + 0)) + == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 1, + 0) := 200]; + assume _v2.value_is(_v2.__ctobpl_const_49, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)]); + assume _v2.value_is(_v2.__ctobpl_const_50, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 1, + 0)]); + goto inline$_v2.main$0$label_7#2; + + inline$_v2.main$0$label_7#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 67} true; + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)) + == 1; + assert true; + assume _v2.INT_GEQ(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 0); + _v2.OK := _v2.OK + && _v2.Res_VALID_REGION(_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 1, + 1)) + == 1; + assert true; + _v2.Mem_T.UCHAR := _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 1, + 1) := 3]; + assume _v2.value_is(_v2.__ctobpl_const_51, + _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)]); + assume _v2.value_is(_v2.__ctobpl_const_52, + _v2.Mem_T.UCHAR[_v2.INT_PLUS(_v2.Mem_T.se_rsn_ie_ieee80211_scan_entry[_v2.se_rsn_ie_ieee80211_scan_entry(inline$_v2.main$0$se)], + 1, + 1)]); + goto inline$_v2.main$0$label_8#2; + + inline$_v2.main$0$label_8#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 69} true; + assume _v2.INT_GT(inline$_v2.main$0$se, 0); + assume _v2.INT_GT(inline$_v2.main$0$se, 0); + _v2.giwscan_cb_in_8_0, _v2.giwscan_cb_in_8_1, _v2.giwscan_cb_in_8_2, _v2.giwscan_cb_in_8_3, _v2.giwscan_cb_in_8_4 := inline$_v2.main$0$se, _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + call inline$_v2.main$0$result.giwscan_cb$2 := _v2.giwscan_cb(inline$_v2.main$0$se); + _v2.giwscan_cb_8_done := true; + _v2.giwscan_cb_out_8_0, _v2.giwscan_cb_out_8_1, _v2.giwscan_cb_out_8_2, _v2.giwscan_cb_out_8_3 := inline$_v2.main$0$result.giwscan_cb$2, _v2.alloc, _v2.OK, _v2.Mem_T.UCHAR; + goto inline$_v2.main$0$label_11#2; + + inline$_v2.main$0$label_11#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 71} true; + inline$_v2.main$0$result.main$1 := 0; + goto inline$_v2.main$0$label_1#2; + + inline$_v2.main$0$label_1#2: + _v2.OK := _v2.OK && true; + assert {:sourcefile "d:\tvm\projects\symb_diff\benchmarks\verisec-suite\programs\apps\madwifi\cve-2006-6332\ok\interproc_ok.c"} {:sourceline 72} true; + _v2.__HAVOC_free_in_9_0, _v2.__HAVOC_free_in_9_1, _v2.__HAVOC_free_in_9_2, _v2.__HAVOC_free_in_9_3, _v2.__HAVOC_free_in_9_4 := inline$_v2.main$0$ie, _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + call _v2.__HAVOC_free(inline$_v2.main$0$ie); + _v2.__HAVOC_free_9_done := true; + _v2.__HAVOC_free_in_10_0, _v2.__HAVOC_free_in_10_1, _v2.__HAVOC_free_in_10_2, _v2.__HAVOC_free_in_10_3, _v2.__HAVOC_free_in_10_4 := inline$_v2.main$0$se, _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + call _v2.__HAVOC_free(inline$_v2.main$0$se); + _v2.__HAVOC_free_10_done := true; + goto inline$_v2.main$0$Return; + + inline$_v2.main$0$Return: + assume true; + _v2.result.main$1 := inline$_v2.main$0$result.main$1; + goto START$2; + + START$2: + goto MS_L_0_8; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_6_done; + store__0__v1.alloc, store__0__v1.OK, store__0__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__0__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__0__v2.alloc, store__0__v2.OK, store__0__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__0__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_1_1, _v1.__HAVOC_det_malloc_in_1_2, _v1.__HAVOC_det_malloc_in_1_3, _v1.__HAVOC_det_malloc_in_1_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_6_1, _v2.__HAVOC_det_malloc_in_6_2, _v2.__HAVOC_det_malloc_in_6_3, _v2.__HAVOC_det_malloc_in_6_4; + call out__v1.__HAVOC_det_malloc_out_1_0_0, out__v2.__HAVOC_det_malloc_out_6_0_0 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_1_0, _v2.__HAVOC_det_malloc_in_6_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_1_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_6_1; + assume _v1.__HAVOC_det_malloc_out_1_0 == out__v1.__HAVOC_det_malloc_out_1_0_0 + && _v2.__HAVOC_det_malloc_out_6_0 == out__v2.__HAVOC_det_malloc_out_6_0_0; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__0__v1.alloc, store__0__v1.OK, store__0__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__0__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__0__v2.alloc, store__0__v2.OK, store__0__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__0__v2.Mem_T.UCHAR; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_6_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; + + MS_L_0_1: + goto MS_L_taken_1, MS_L_not_taken_1; + + MS_L_taken_1: + assume _v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_7_done; + store__1__v1.alloc, store__1__v1.OK, store__1__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__1__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__1__v2.alloc, store__1__v2.OK, store__1__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__1__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_1_1, _v1.__HAVOC_det_malloc_in_1_2, _v1.__HAVOC_det_malloc_in_1_3, _v1.__HAVOC_det_malloc_in_1_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_7_1, _v2.__HAVOC_det_malloc_in_7_2, _v2.__HAVOC_det_malloc_in_7_3, _v2.__HAVOC_det_malloc_in_7_4; + call out__v1.__HAVOC_det_malloc_out_1_0_1, out__v2.__HAVOC_det_malloc_out_7_0_1 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_1_0, _v2.__HAVOC_det_malloc_in_7_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_1_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_7_1; + assume _v1.__HAVOC_det_malloc_out_1_0 == out__v1.__HAVOC_det_malloc_out_1_0_1 + && _v2.__HAVOC_det_malloc_out_7_0 == out__v2.__HAVOC_det_malloc_out_7_0_1; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__1__v1.alloc, store__1__v1.OK, store__1__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__1__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__1__v2.alloc, store__1__v2.OK, store__1__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__1__v2.Mem_T.UCHAR; + goto MS_L_meet_1; + + MS_L_not_taken_1: + assume !(_v1.__HAVOC_det_malloc_1_done && _v2.__HAVOC_det_malloc_7_done); + goto MS_L_meet_1; + + MS_L_meet_1: + goto MS_L_0_0; + + MS_L_0_2: + goto MS_L_taken_2, MS_L_not_taken_2; + + MS_L_taken_2: + assume _v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_6_done; + store__2__v1.alloc, store__2__v1.OK, store__2__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__2__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__2__v2.alloc, store__2__v2.OK, store__2__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__2__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_2_1, _v1.__HAVOC_det_malloc_in_2_2, _v1.__HAVOC_det_malloc_in_2_3, _v1.__HAVOC_det_malloc_in_2_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_6_1, _v2.__HAVOC_det_malloc_in_6_2, _v2.__HAVOC_det_malloc_in_6_3, _v2.__HAVOC_det_malloc_in_6_4; + call out__v1.__HAVOC_det_malloc_out_2_0_2, out__v2.__HAVOC_det_malloc_out_6_0_2 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_2_0, _v2.__HAVOC_det_malloc_in_6_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_2_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_6_1; + assume _v1.__HAVOC_det_malloc_out_2_0 == out__v1.__HAVOC_det_malloc_out_2_0_2 + && _v2.__HAVOC_det_malloc_out_6_0 == out__v2.__HAVOC_det_malloc_out_6_0_2; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__2__v1.alloc, store__2__v1.OK, store__2__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__2__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__2__v2.alloc, store__2__v2.OK, store__2__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__2__v2.Mem_T.UCHAR; + goto MS_L_meet_2; + + MS_L_not_taken_2: + assume !(_v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_6_done); + goto MS_L_meet_2; + + MS_L_meet_2: + goto MS_L_0_1; + + MS_L_0_3: + goto MS_L_taken_3, MS_L_not_taken_3; + + MS_L_taken_3: + assume _v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_7_done; + store__3__v1.alloc, store__3__v1.OK, store__3__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__3__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__3__v2.alloc, store__3__v2.OK, store__3__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__3__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_det_malloc_in_2_1, _v1.__HAVOC_det_malloc_in_2_2, _v1.__HAVOC_det_malloc_in_2_3, _v1.__HAVOC_det_malloc_in_2_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_det_malloc_in_7_1, _v2.__HAVOC_det_malloc_in_7_2, _v2.__HAVOC_det_malloc_in_7_3, _v2.__HAVOC_det_malloc_in_7_4; + call out__v1.__HAVOC_det_malloc_out_2_0_3, out__v2.__HAVOC_det_malloc_out_7_0_3 := MS_Check__v1.__HAVOC_det_malloc___v2.__HAVOC_det_malloc(_v1.__HAVOC_det_malloc_in_2_0, _v2.__HAVOC_det_malloc_in_7_0); + assume _v1.alloc == _v1.__HAVOC_det_malloc_out_2_1; + assume _v2.alloc == _v2.__HAVOC_det_malloc_out_7_1; + assume _v1.__HAVOC_det_malloc_out_2_0 == out__v1.__HAVOC_det_malloc_out_2_0_3 + && _v2.__HAVOC_det_malloc_out_7_0 == out__v2.__HAVOC_det_malloc_out_7_0_3; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__3__v1.alloc, store__3__v1.OK, store__3__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__3__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__3__v2.alloc, store__3__v2.OK, store__3__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__3__v2.Mem_T.UCHAR; + goto MS_L_meet_3; + + MS_L_not_taken_3: + assume !(_v1.__HAVOC_det_malloc_2_done && _v2.__HAVOC_det_malloc_7_done); + goto MS_L_meet_3; + + MS_L_meet_3: + goto MS_L_0_2; + + MS_L_0_4: + goto MS_L_taken_4, MS_L_not_taken_4; + + MS_L_taken_4: + assume _v1.giwscan_cb_3_done && _v2.giwscan_cb_8_done; + store__4__v1.alloc, store__4__v1.OK, store__4__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__4__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__4__v2.alloc, store__4__v2.OK, store__4__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__4__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.giwscan_cb_in_3_1, _v1.giwscan_cb_in_3_2, _v1.giwscan_cb_in_3_3, _v1.giwscan_cb_in_3_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.giwscan_cb_in_8_1, _v2.giwscan_cb_in_8_2, _v2.giwscan_cb_in_8_3, _v2.giwscan_cb_in_8_4; + call out__v1.giwscan_cb_out_3_0_4, out__v2.giwscan_cb_out_8_0_4 := MS_Check__v1.giwscan_cb___v2.giwscan_cb(_v1.giwscan_cb_in_3_0, _v2.giwscan_cb_in_8_0); + assume _v1.alloc == _v1.giwscan_cb_out_3_1 + && (_v1.OK <==> _v1.giwscan_cb_out_3_2) + && _v1.Mem_T.UCHAR == _v1.giwscan_cb_out_3_3; + assume _v2.alloc == _v2.giwscan_cb_out_8_1 + && (_v2.OK <==> _v2.giwscan_cb_out_8_2) + && _v2.Mem_T.UCHAR == _v2.giwscan_cb_out_8_3; + assume _v1.giwscan_cb_out_3_0 == out__v1.giwscan_cb_out_3_0_4 + && _v2.giwscan_cb_out_8_0 == out__v2.giwscan_cb_out_8_0_4; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__4__v1.alloc, store__4__v1.OK, store__4__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__4__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__4__v2.alloc, store__4__v2.OK, store__4__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__4__v2.Mem_T.UCHAR; + goto MS_L_meet_4; + + MS_L_not_taken_4: + assume !(_v1.giwscan_cb_3_done && _v2.giwscan_cb_8_done); + goto MS_L_meet_4; + + MS_L_meet_4: + goto MS_L_0_3; + + MS_L_0_5: + goto MS_L_taken_5, MS_L_not_taken_5; + + MS_L_taken_5: + assume _v1.__HAVOC_free_4_done && _v2.__HAVOC_free_9_done; + store__5__v1.alloc, store__5__v1.OK, store__5__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__5__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__5__v2.alloc, store__5__v2.OK, store__5__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__5__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_4_1, _v1.__HAVOC_free_in_4_2, _v1.__HAVOC_free_in_4_3, _v1.__HAVOC_free_in_4_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_9_1, _v2.__HAVOC_free_in_9_2, _v2.__HAVOC_free_in_9_3, _v2.__HAVOC_free_in_9_4; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_4_0, _v2.__HAVOC_free_in_9_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__5__v1.alloc, store__5__v1.OK, store__5__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__5__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__5__v2.alloc, store__5__v2.OK, store__5__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__5__v2.Mem_T.UCHAR; + goto MS_L_meet_5; + + MS_L_not_taken_5: + assume !(_v1.__HAVOC_free_4_done && _v2.__HAVOC_free_9_done); + goto MS_L_meet_5; + + MS_L_meet_5: + goto MS_L_0_4; + + MS_L_0_6: + goto MS_L_taken_6, MS_L_not_taken_6; + + MS_L_taken_6: + assume _v1.__HAVOC_free_4_done && _v2.__HAVOC_free_10_done; + store__6__v1.alloc, store__6__v1.OK, store__6__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__6__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__6__v2.alloc, store__6__v2.OK, store__6__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__6__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_4_1, _v1.__HAVOC_free_in_4_2, _v1.__HAVOC_free_in_4_3, _v1.__HAVOC_free_in_4_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_10_1, _v2.__HAVOC_free_in_10_2, _v2.__HAVOC_free_in_10_3, _v2.__HAVOC_free_in_10_4; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_4_0, _v2.__HAVOC_free_in_10_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__6__v1.alloc, store__6__v1.OK, store__6__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__6__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__6__v2.alloc, store__6__v2.OK, store__6__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__6__v2.Mem_T.UCHAR; + goto MS_L_meet_6; + + MS_L_not_taken_6: + assume !(_v1.__HAVOC_free_4_done && _v2.__HAVOC_free_10_done); + goto MS_L_meet_6; + + MS_L_meet_6: + goto MS_L_0_5; + + MS_L_0_7: + goto MS_L_taken_7, MS_L_not_taken_7; + + MS_L_taken_7: + assume _v1.__HAVOC_free_5_done && _v2.__HAVOC_free_9_done; + store__7__v1.alloc, store__7__v1.OK, store__7__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__7__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__7__v2.alloc, store__7__v2.OK, store__7__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__7__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_5_1, _v1.__HAVOC_free_in_5_2, _v1.__HAVOC_free_in_5_3, _v1.__HAVOC_free_in_5_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_9_1, _v2.__HAVOC_free_in_9_2, _v2.__HAVOC_free_in_9_3, _v2.__HAVOC_free_in_9_4; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_5_0, _v2.__HAVOC_free_in_9_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__7__v1.alloc, store__7__v1.OK, store__7__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__7__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__7__v2.alloc, store__7__v2.OK, store__7__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__7__v2.Mem_T.UCHAR; + goto MS_L_meet_7; + + MS_L_not_taken_7: + assume !(_v1.__HAVOC_free_5_done && _v2.__HAVOC_free_9_done); + goto MS_L_meet_7; + + MS_L_meet_7: + goto MS_L_0_6; + + MS_L_0_8: + goto MS_L_taken_8, MS_L_not_taken_8; + + MS_L_taken_8: + assume _v1.__HAVOC_free_5_done && _v2.__HAVOC_free_10_done; + store__8__v1.alloc, store__8__v1.OK, store__8__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__8__v1.Mem_T.UCHAR := _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR; + store__8__v2.alloc, store__8__v2.OK, store__8__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__8__v2.Mem_T.UCHAR := _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := _v1.__HAVOC_free_in_5_1, _v1.__HAVOC_free_in_5_2, _v1.__HAVOC_free_in_5_3, _v1.__HAVOC_free_in_5_4; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := _v2.__HAVOC_free_in_10_1, _v2.__HAVOC_free_in_10_2, _v2.__HAVOC_free_in_10_3, _v2.__HAVOC_free_in_10_4; + call MS_Check__v1.__HAVOC_free___v2.__HAVOC_free(_v1.__HAVOC_free_in_5_0, _v2.__HAVOC_free_in_10_0); + assume true; + assume true; + assume true; + _v1.alloc, _v1.OK, _v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v1.Mem_T.UCHAR := store__8__v1.alloc, store__8__v1.OK, store__8__v1.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__8__v1.Mem_T.UCHAR; + _v2.alloc, _v2.OK, _v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, _v2.Mem_T.UCHAR := store__8__v2.alloc, store__8__v2.OK, store__8__v2.Mem_T.se_rsn_ie_ieee80211_scan_entry, store__8__v2.Mem_T.UCHAR; + goto MS_L_meet_8; + + MS_L_not_taken_8: + assume !(_v1.__HAVOC_free_5_done && _v2.__HAVOC_free_10_done); + goto MS_L_meet_8; + + MS_L_meet_8: + goto MS_L_0_7; +} + + diff --git a/Test/houdini/mergedProgSingle_dac.bpl.expect b/Test/houdini/mergedProgSingle_dac.bpl.expect new file mode 100644 index 00000000..75750967 --- /dev/null +++ b/Test/houdini/mergedProgSingle_dac.bpl.expect @@ -0,0 +1,190 @@ +Assignment computed by Houdini: +_houdini_0 = False +_houdini_1 = False +_houdini_2 = False +_houdini_3 = False +_houdini_4 = True +_houdini_5 = True +_houdini_6 = True +_houdini_7 = True +_houdini_8 = True +_houdini_9 = True +_houdini_10 = True +_houdini_11 = True +_houdini_12 = True +_houdini_13 = True +_houdini_14 = True +_houdini_15 = True +_houdini_16 = False +_houdini_17 = True +_houdini_18 = True +_houdini_19 = True +_houdini_20 = True +_houdini_21 = True +_houdini_22 = True +_houdini_23 = True +_houdini_24 = False +_houdini_25 = False +_houdini_26 = True +_houdini_27 = True +_houdini_28 = True +_houdini_29 = False +_houdini_30 = False +_houdini_31 = True +_houdini_32 = True +_houdini_33 = True +_houdini_34 = True +_houdini_35 = True +_houdini_36 = True +_houdini_37 = True +_houdini_38 = True +_houdini_39 = True +_houdini_40 = True +_houdini_41 = True +_houdini_42 = True +_houdini_43 = True +_houdini_44 = True +_houdini_45 = True +_houdini_46 = True +_houdini_47 = True +_houdini_48 = True +_houdini_49 = True +_houdini_50 = True +_houdini_51 = True +_houdini_52 = True +_houdini_53 = True +_houdini_54 = True +_houdini_55 = True +_houdini_56 = True +_houdini_57 = True +_houdini_58 = True +_houdini_59 = True +_houdini_60 = True +_houdini_61 = True +_houdini_62 = True +_houdini_63 = True +_houdini_64 = True +_houdini_65 = True +_houdini_66 = True +_houdini_67 = True +_houdini_68 = True +_houdini_69 = True +_houdini_70 = True +_houdini_71 = True +_houdini_72 = True +_houdini_73 = True +_houdini_74 = True +_houdini_75 = True +_houdini_76 = False +_houdini_77 = False +_houdini_78 = True +_houdini_79 = False +_houdini_80 = False +_houdini_81 = True +_houdini_82 = True +_houdini_83 = True +_houdini_84 = True +_houdini_85 = True +_houdini_86 = True +_houdini_87 = True +_houdini_88 = True +_houdini_89 = True +_houdini_90 = True +_houdini_91 = True +_houdini_92 = True +_houdini_93 = True +_houdini_94 = True +_houdini_95 = True +_houdini_96 = True +_houdini_97 = True +_houdini_98 = True +_houdini_99 = True +_houdini_100 = True +_houdini_101 = True +_houdini_102 = True +_houdini_103 = True +_houdini_104 = True +_houdini_105 = True +_houdini_106 = True +_houdini_107 = True +_houdini_108 = True +_houdini_109 = True +_houdini_110 = True +_houdini_111 = True +_houdini_112 = True +_houdini_113 = True +_houdini_114 = True +_houdini_115 = False +_houdini_116 = False +_houdini_117 = False +_houdini_118 = False +_houdini_119 = False +_houdini_120 = False +_houdini_121 = False +_houdini_122 = True +_houdini_123 = False +_houdini_124 = False +_houdini_125 = True +_houdini_126 = True +_houdini_127 = True +_houdini_128 = True +_houdini_129 = True +_houdini_130 = True +_houdini_131 = True +_houdini_132 = False +_houdini_133 = False +_houdini_134 = True +_houdini_135 = True +_houdini_136 = True +_houdini_137 = True +_houdini_138 = True +_houdini_139 = True +_houdini_140 = True +_houdini_141 = True +_houdini_142 = True +_houdini_143 = True +_houdini_144 = True +_houdini_145 = True +_houdini_146 = True +_houdini_147 = True +_houdini_148 = True +_houdini_149 = True +_houdini_150 = True +_houdini_151 = True +_houdini_152 = True +_houdini_153 = True +_houdini_154 = True +_houdini_155 = True +_houdini_156 = True +_houdini_157 = True +_houdini_158 = True +_houdini_159 = True +_houdini_160 = True +_houdini_161 = False +_houdini_162 = False +_houdini_163 = True +_houdini_164 = True +_houdini_165 = True +_houdini_166 = True +_houdini_167 = True +_houdini_168 = True +_houdini_169 = True +_houdini_170 = True +_houdini_171 = True +_houdini_172 = True +_houdini_173 = True +_houdini_174 = True +_houdini_175 = True +_houdini_176 = True +_houdini_177 = True +_houdini_178 = True +_houdini_179 = True +_houdini_180 = True +_houdini_181 = True +_houdini_182 = True +_houdini_183 = True +_houdini_184 = True +_houdini_185 = True +_houdini_186 = True + +Boogie program verifier finished with 12 verified, 0 errors diff --git a/Test/houdini/mergedProgSingle_res_ex1.bpl b/Test/houdini/mergedProgSingle_res_ex1.bpl new file mode 100644 index 00000000..9313075a --- /dev/null +++ b/Test/houdini/mergedProgSingle_res_ex1.bpl @@ -0,0 +1,621 @@ +// RUN: %boogie /nologo /contractInfer /inlineDepth:1 /printAssignment /noinfer "%s" > "%t" +// RUN: %diff "%s.expect" "%t" + +var _v2.control_flag: int; + +function _v2.control_UIF(arg_0: int, arg_1: int) : int; + +procedure _v2.Eval(x: int) returns (result: int); + modifies _v2.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + + + +procedure _v2.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int); + modifies _v2.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + + + +implementation _v2.Eval(x.1: int) returns (result: int) +{ + var x: int; + + anon0: + x := x.1; + result := 0; + _v2.control_flag := 0; + goto anon3_LoopHead; + + anon3_LoopHead: + call result, x := _v2.Eval_loop_anon3_LoopHead(result, x); + goto anon3_LoopHead_last; + + anon3_LoopHead_last: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + result := result + x; + havoc result; + x := x - 1; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + assume false; + return; + + anon3_LoopDone: + assume {:partition} 0 >= x; + goto anon2; + + anon2: + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 2); + return; +} + + + +implementation _v2.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int) +{ + + entry: + out_result, out_x := in_result, in_x; + goto anon3_LoopHead; + + anon3_LoopHead: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} out_x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + out_result := out_result + out_x; + havoc out_result; + out_x := out_x - 1; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + call out_result, out_x := _v2.Eval_loop_anon3_LoopHead(out_result, out_x); + return; + + anon3_LoopDone: + assume {:partition} 0 >= out_x; + out_result, out_x := in_result, in_x; + _v2.control_flag := old(_v2.control_flag); + return; +} + + + +var _v1.control_flag: int; + +procedure _v1.Eval(x: int) returns (result: int); + modifies _v1.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + + + +procedure _v1.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int); + modifies _v1.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + + + +implementation _v1.Eval(x.1: int) returns (result: int) +{ + var x: int; + + anon0: + x := x.1; + result := 0; + _v1.control_flag := 0; + goto anon3_LoopHead; + + anon3_LoopHead: + call result, x := _v1.Eval_loop_anon3_LoopHead(result, x); + goto anon3_LoopHead_last; + + anon3_LoopHead_last: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + result := result + x; + x := x - 1; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + assume false; + return; + + anon3_LoopDone: + assume {:partition} 0 >= x; + goto anon2; + + anon2: + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 2); + return; +} + + + +implementation _v1.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int) +{ + + entry: + out_result, out_x := in_result, in_x; + goto anon3_LoopHead; + + anon3_LoopHead: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} out_x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + out_result := out_result + out_x; + out_x := out_x - 1; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + call out_result, out_x := _v1.Eval_loop_anon3_LoopHead(out_result, out_x); + return; + + anon3_LoopDone: + assume {:partition} 0 >= out_x; + out_result, out_x := in_result, in_x; + _v1.control_flag := old(_v1.control_flag); + return; +} + + + +function {:inline true} MS$_v1.Eval$_v2.Eval(_v1.x: int, + _v1.control_flag_old: int, + _v1.control_flag_: int, + _v1.result: int, + _v2.x: int, + _v2.control_flag_old: int, + _v2.control_flag_: int, + _v2.result: int) + : bool +{ + true +} + +const {:existential true} _houdini_Eval_control_flag_0: bool; + +const {:existential true} _houdini_Eval_result_1: bool; + +procedure MS_Check__v1.Eval___v2.Eval(_v1.x: int, _v2.x: int) returns (_v1.result: int, _v2.result: int); + modifies _v1.control_flag, _v2.control_flag; + ensures MS$_v1.Eval$_v2.Eval(_v1.x, + old(_v1.control_flag), + _v1.control_flag, + _v1.result, + _v2.x, + old(_v2.control_flag), + _v2.control_flag, + _v2.result); + ensures _houdini_Eval_control_flag_0 + ==> + old(_v1.control_flag == _v2.control_flag && _v1.x == _v2.x) + ==> _v1.control_flag == _v2.control_flag; + ensures _houdini_Eval_result_1 ==> old(_v1.x == _v2.x) ==> _v1.result == _v2.result; + + + +implementation MS_Check__v1.Eval___v2.Eval(_v1.x: int, _v2.x: int) returns (_v1.result: int, _v2.result: int) +{ + var inline$_v1.Eval$0$x: int; + var inline$_v1.Eval$0$x.1: int; + var inline$_v1.Eval$0$result: int; + var inline$_v1.Eval$0$_v1.control_flag: int; + var inline$_v2.Eval$0$x: int; + var inline$_v2.Eval$0$x.1: int; + var inline$_v2.Eval$0$result: int; + var inline$_v2.Eval$0$_v2.control_flag: int; + var _v1.Eval_loop_anon3_LoopHead_1_done: bool; + var _v1.Eval_loop_anon3_LoopHead_in_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_2: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_2: int; + var _v2.Eval_loop_anon3_LoopHead_2_done: bool; + var _v2.Eval_loop_anon3_LoopHead_in_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_2: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_2: int; + var store__0__v1.control_flag: int; + var store__0__v2.control_flag: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_0_0: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_1_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_0_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_1_0: int; + + START: + _v1.Eval_loop_anon3_LoopHead_1_done, _v2.Eval_loop_anon3_LoopHead_2_done := false, false; + goto inline$_v1.Eval$0$Entry; + + inline$_v1.Eval$0$Entry: + inline$_v1.Eval$0$x.1 := _v1.x; + havoc inline$_v1.Eval$0$x, inline$_v1.Eval$0$result; + inline$_v1.Eval$0$_v1.control_flag := _v1.control_flag; + goto inline$_v1.Eval$0$anon0; + + inline$_v1.Eval$0$anon0: + inline$_v1.Eval$0$x := inline$_v1.Eval$0$x.1; + inline$_v1.Eval$0$result := 0; + _v1.control_flag := 0; + goto inline$_v1.Eval$0$anon3_LoopHead; + + inline$_v1.Eval$0$anon3_LoopHead: + _v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v1.Eval_loop_anon3_LoopHead_in_1_2 := inline$_v1.Eval$0$result, inline$_v1.Eval$0$x, _v1.control_flag; + call inline$_v1.Eval$0$result, inline$_v1.Eval$0$x := _v1.Eval_loop_anon3_LoopHead(inline$_v1.Eval$0$result, inline$_v1.Eval$0$x); + _v1.Eval_loop_anon3_LoopHead_1_done := true; + _v1.Eval_loop_anon3_LoopHead_out_1_0, _v1.Eval_loop_anon3_LoopHead_out_1_1, _v1.Eval_loop_anon3_LoopHead_out_1_2 := inline$_v1.Eval$0$result, inline$_v1.Eval$0$x, _v1.control_flag; + goto inline$_v1.Eval$0$anon3_LoopHead_last; + + inline$_v1.Eval$0$anon3_LoopHead_last: + goto inline$_v1.Eval$0$anon3_LoopDone, inline$_v1.Eval$0$anon3_LoopBody; + + inline$_v1.Eval$0$anon3_LoopBody: + assume {:partition} inline$_v1.Eval$0$x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + inline$_v1.Eval$0$result := inline$_v1.Eval$0$result + inline$_v1.Eval$0$x; + inline$_v1.Eval$0$x := inline$_v1.Eval$0$x - 1; + goto inline$_v1.Eval$0$anon3_LoopBody_dummy; + + inline$_v1.Eval$0$anon3_LoopBody_dummy: + assume false; + goto inline$_v1.Eval$0$Return; + + inline$_v1.Eval$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v1.Eval$0$x; + goto inline$_v1.Eval$0$anon2; + + inline$_v1.Eval$0$anon2: + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 2); + goto inline$_v1.Eval$0$Return; + + inline$_v1.Eval$0$Return: + assume true; + assume true; + assume true; + assume true; + _v1.result := inline$_v1.Eval$0$result; + goto START$1; + + START$1: + goto inline$_v2.Eval$0$Entry; + + inline$_v2.Eval$0$Entry: + inline$_v2.Eval$0$x.1 := _v2.x; + havoc inline$_v2.Eval$0$x, inline$_v2.Eval$0$result; + inline$_v2.Eval$0$_v2.control_flag := _v2.control_flag; + goto inline$_v2.Eval$0$anon0; + + inline$_v2.Eval$0$anon0: + inline$_v2.Eval$0$x := inline$_v2.Eval$0$x.1; + inline$_v2.Eval$0$result := 0; + _v2.control_flag := 0; + goto inline$_v2.Eval$0$anon3_LoopHead; + + inline$_v2.Eval$0$anon3_LoopHead: + _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1, _v2.Eval_loop_anon3_LoopHead_in_2_2 := inline$_v2.Eval$0$result, inline$_v2.Eval$0$x, _v2.control_flag; + call inline$_v2.Eval$0$result, inline$_v2.Eval$0$x := _v2.Eval_loop_anon3_LoopHead(inline$_v2.Eval$0$result, inline$_v2.Eval$0$x); + _v2.Eval_loop_anon3_LoopHead_2_done := true; + _v2.Eval_loop_anon3_LoopHead_out_2_0, _v2.Eval_loop_anon3_LoopHead_out_2_1, _v2.Eval_loop_anon3_LoopHead_out_2_2 := inline$_v2.Eval$0$result, inline$_v2.Eval$0$x, _v2.control_flag; + goto inline$_v2.Eval$0$anon3_LoopHead_last; + + inline$_v2.Eval$0$anon3_LoopHead_last: + goto inline$_v2.Eval$0$anon3_LoopDone, inline$_v2.Eval$0$anon3_LoopBody; + + inline$_v2.Eval$0$anon3_LoopBody: + assume {:partition} inline$_v2.Eval$0$x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + inline$_v2.Eval$0$result := inline$_v2.Eval$0$result + inline$_v2.Eval$0$x; + havoc inline$_v2.Eval$0$result; + inline$_v2.Eval$0$x := inline$_v2.Eval$0$x - 1; + goto inline$_v2.Eval$0$anon3_LoopBody_dummy; + + inline$_v2.Eval$0$anon3_LoopBody_dummy: + assume false; + goto inline$_v2.Eval$0$Return; + + inline$_v2.Eval$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v2.Eval$0$x; + goto inline$_v2.Eval$0$anon2; + + inline$_v2.Eval$0$anon2: + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 2); + goto inline$_v2.Eval$0$Return; + + inline$_v2.Eval$0$Return: + assume true; + assume true; + assume true; + assume true; + _v2.result := inline$_v2.Eval$0$result; + goto START$2; + + START$2: + goto MS_L_0_0; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done; + store__0__v1.control_flag := _v1.control_flag; + store__0__v2.control_flag := _v2.control_flag; + _v1.control_flag := _v1.Eval_loop_anon3_LoopHead_in_1_2; + _v2.control_flag := _v2.Eval_loop_anon3_LoopHead_in_2_2; + call out__v1.Eval_loop_anon3_LoopHead_out_1_0_0, out__v1.Eval_loop_anon3_LoopHead_out_1_1_0, out__v2.Eval_loop_anon3_LoopHead_out_2_0_0, out__v2.Eval_loop_anon3_LoopHead_out_2_1_0 := MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1); + assume _v1.control_flag == _v1.Eval_loop_anon3_LoopHead_out_1_2; + assume _v2.control_flag == _v2.Eval_loop_anon3_LoopHead_out_2_2; + assume _v1.Eval_loop_anon3_LoopHead_out_1_0 + == out__v1.Eval_loop_anon3_LoopHead_out_1_0_0 + && _v1.Eval_loop_anon3_LoopHead_out_1_1 + == out__v1.Eval_loop_anon3_LoopHead_out_1_1_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_0 + == out__v2.Eval_loop_anon3_LoopHead_out_2_0_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_1 + == out__v2.Eval_loop_anon3_LoopHead_out_2_1_0; + _v1.control_flag := store__0__v1.control_flag; + _v2.control_flag := store__0__v2.control_flag; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; +} + + + +function {:inline true} MS$_v1.Eval_loop_anon3_LoopHead$_v2.Eval_loop_anon3_LoopHead(_v1.in_result: int, + _v1.in_x: int, + _v1.control_flag_old: int, + _v1.control_flag_: int, + _v1.out_result: int, + _v1.out_x: int, + _v2.in_result: int, + _v2.in_x: int, + _v2.control_flag_old: int, + _v2.control_flag_: int, + _v2.out_result: int, + _v2.out_x: int) + : bool +{ + true +} + +const {:existential true} _houdini_Eval_loop_anon3_LoopHead_control_flag_2: bool; + +const {:existential true} _houdini_Eval_loop_anon3_LoopHead_out_result_3: bool; + +const {:existential true} _houdini_Eval_loop_anon3_LoopHead_out_x_4: bool; + +procedure MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.in_result: int, _v1.in_x: int, _v2.in_result: int, _v2.in_x: int) + returns (_v1.out_result: int, _v1.out_x: int, _v2.out_result: int, _v2.out_x: int); + modifies _v1.control_flag, _v2.control_flag; + ensures MS$_v1.Eval_loop_anon3_LoopHead$_v2.Eval_loop_anon3_LoopHead(_v1.in_result, + _v1.in_x, + old(_v1.control_flag), + _v1.control_flag, + _v1.out_result, + _v1.out_x, + _v2.in_result, + _v2.in_x, + old(_v2.control_flag), + _v2.control_flag, + _v2.out_result, + _v2.out_x); + ensures _houdini_Eval_loop_anon3_LoopHead_control_flag_2 + ==> + old(_v1.control_flag == _v2.control_flag && _v1.in_x == _v2.in_x) + ==> _v1.control_flag == _v2.control_flag; + ensures _houdini_Eval_loop_anon3_LoopHead_out_result_3 + ==> + old(_v1.in_result == _v2.in_result && _v1.in_x == _v2.in_x) + ==> _v1.out_result == _v2.out_result; + ensures _houdini_Eval_loop_anon3_LoopHead_out_x_4 + ==> + old(_v1.in_x == _v2.in_x) + ==> _v1.out_x == _v2.out_x; + + + +implementation MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.in_result: int, _v1.in_x: int, _v2.in_result: int, _v2.in_x: int) + returns (_v1.out_result: int, _v1.out_x: int, _v2.out_result: int, _v2.out_x: int) +{ + var inline$_v1.Eval_loop_anon3_LoopHead$0$in_result: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$in_x: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$out_result: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$out_x: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$_v1.control_flag: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$in_result: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$in_x: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$out_result: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$out_x: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$_v2.control_flag: int; + var _v1.Eval_loop_anon3_LoopHead_1_done: bool; + var _v1.Eval_loop_anon3_LoopHead_in_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_2: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_2: int; + var _v2.Eval_loop_anon3_LoopHead_2_done: bool; + var _v2.Eval_loop_anon3_LoopHead_in_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_2: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_2: int; + var store__0__v1.control_flag: int; + var store__0__v2.control_flag: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_0_0: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_1_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_0_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_1_0: int; + + START: + _v1.Eval_loop_anon3_LoopHead_1_done, _v2.Eval_loop_anon3_LoopHead_2_done := false, false; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$Entry; + + inline$_v1.Eval_loop_anon3_LoopHead$0$Entry: + inline$_v1.Eval_loop_anon3_LoopHead$0$in_result := _v1.in_result; + inline$_v1.Eval_loop_anon3_LoopHead$0$in_x := _v1.in_x; + havoc inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v1.Eval_loop_anon3_LoopHead$0$_v1.control_flag := _v1.control_flag; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$entry; + + inline$_v1.Eval_loop_anon3_LoopHead$0$entry: + inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$in_result, inline$_v1.Eval_loop_anon3_LoopHead$0$in_x; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopHead; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopHead: + goto inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopDone, inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody: + assume {:partition} inline$_v1.Eval_loop_anon3_LoopHead$0$out_x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + inline$_v1.Eval_loop_anon3_LoopHead$0$out_result := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result + + inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$out_x - 1; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy: + _v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v1.Eval_loop_anon3_LoopHead_in_1_2 := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x, _v1.control_flag; + call inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := _v1.Eval_loop_anon3_LoopHead(inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x); + _v1.Eval_loop_anon3_LoopHead_1_done := true; + _v1.Eval_loop_anon3_LoopHead_out_1_0, _v1.Eval_loop_anon3_LoopHead_out_1_1, _v1.Eval_loop_anon3_LoopHead_out_1_2 := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x, _v1.control_flag; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$in_result, inline$_v1.Eval_loop_anon3_LoopHead$0$in_x; + _v1.control_flag := inline$_v1.Eval_loop_anon3_LoopHead$0$_v1.control_flag; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v1.Eval_loop_anon3_LoopHead$0$Return: + assume true; + assume true; + assume true; + assume true; + assume true; + assume true; + _v1.out_result := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result; + _v1.out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + goto START$1; + + START$1: + goto inline$_v2.Eval_loop_anon3_LoopHead$0$Entry; + + inline$_v2.Eval_loop_anon3_LoopHead$0$Entry: + inline$_v2.Eval_loop_anon3_LoopHead$0$in_result := _v2.in_result; + inline$_v2.Eval_loop_anon3_LoopHead$0$in_x := _v2.in_x; + havoc inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v2.Eval_loop_anon3_LoopHead$0$_v2.control_flag := _v2.control_flag; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$entry; + + inline$_v2.Eval_loop_anon3_LoopHead$0$entry: + inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$in_result, inline$_v2.Eval_loop_anon3_LoopHead$0$in_x; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopHead; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopHead: + goto inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopDone, inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody: + assume {:partition} inline$_v2.Eval_loop_anon3_LoopHead$0$out_x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + inline$_v2.Eval_loop_anon3_LoopHead$0$out_result := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result + + inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + havoc inline$_v2.Eval_loop_anon3_LoopHead$0$out_result; + inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$out_x - 1; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy: + _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1, _v2.Eval_loop_anon3_LoopHead_in_2_2 := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x, _v2.control_flag; + call inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := _v2.Eval_loop_anon3_LoopHead(inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x); + _v2.Eval_loop_anon3_LoopHead_2_done := true; + _v2.Eval_loop_anon3_LoopHead_out_2_0, _v2.Eval_loop_anon3_LoopHead_out_2_1, _v2.Eval_loop_anon3_LoopHead_out_2_2 := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x, _v2.control_flag; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$in_result, inline$_v2.Eval_loop_anon3_LoopHead$0$in_x; + _v2.control_flag := inline$_v2.Eval_loop_anon3_LoopHead$0$_v2.control_flag; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v2.Eval_loop_anon3_LoopHead$0$Return: + assume true; + assume true; + assume true; + assume true; + assume true; + assume true; + _v2.out_result := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result; + _v2.out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + goto START$2; + + START$2: + goto MS_L_0_0; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done; + store__0__v1.control_flag := _v1.control_flag; + store__0__v2.control_flag := _v2.control_flag; + _v1.control_flag := _v1.Eval_loop_anon3_LoopHead_in_1_2; + _v2.control_flag := _v2.Eval_loop_anon3_LoopHead_in_2_2; + call out__v1.Eval_loop_anon3_LoopHead_out_1_0_0, out__v1.Eval_loop_anon3_LoopHead_out_1_1_0, out__v2.Eval_loop_anon3_LoopHead_out_2_0_0, out__v2.Eval_loop_anon3_LoopHead_out_2_1_0 := MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1); + assume _v1.control_flag == _v1.Eval_loop_anon3_LoopHead_out_1_2; + assume _v2.control_flag == _v2.Eval_loop_anon3_LoopHead_out_2_2; + assume _v1.Eval_loop_anon3_LoopHead_out_1_0 + == out__v1.Eval_loop_anon3_LoopHead_out_1_0_0 + && _v1.Eval_loop_anon3_LoopHead_out_1_1 + == out__v1.Eval_loop_anon3_LoopHead_out_1_1_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_0 + == out__v2.Eval_loop_anon3_LoopHead_out_2_0_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_1 + == out__v2.Eval_loop_anon3_LoopHead_out_2_1_0; + _v1.control_flag := store__0__v1.control_flag; + _v2.control_flag := store__0__v2.control_flag; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; +} + + diff --git a/Test/houdini/mergedProgSingle_res_ex1.bpl.expect b/Test/houdini/mergedProgSingle_res_ex1.bpl.expect new file mode 100644 index 00000000..ead49d31 --- /dev/null +++ b/Test/houdini/mergedProgSingle_res_ex1.bpl.expect @@ -0,0 +1,8 @@ +Assignment computed by Houdini: +_houdini_Eval_control_flag_0 = True +_houdini_Eval_result_1 = False +_houdini_Eval_loop_anon3_LoopHead_control_flag_2 = True +_houdini_Eval_loop_anon3_LoopHead_out_result_3 = False +_houdini_Eval_loop_anon3_LoopHead_out_x_4 = True + +Boogie program verifier finished with 6 verified, 0 errors diff --git a/Test/houdini/mergedProgSingle_res_ex2.bpl b/Test/houdini/mergedProgSingle_res_ex2.bpl new file mode 100644 index 00000000..2337d434 --- /dev/null +++ b/Test/houdini/mergedProgSingle_res_ex2.bpl @@ -0,0 +1,621 @@ +// RUN: %boogie /nologo /contractInfer /inlineDepth:1 /printAssignment /noinfer "%s" > "%t" +// RUN: %diff "%s.expect" "%t" + +var _v2.control_flag: int; + +function _v2.control_UIF(arg_0: int, arg_1: int) : int; + +procedure _v2.Eval(x: int) returns (result: int); + modifies _v2.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + + + +procedure _v2.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int); + modifies _v2.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + + + +implementation _v2.Eval(x.1: int) returns (result: int) +{ + var x: int; + + anon0: + x := x.1; + result := 0; + _v2.control_flag := 0; + goto anon3_LoopHead; + + anon3_LoopHead: + call result, x := _v2.Eval_loop_anon3_LoopHead(result, x); + goto anon3_LoopHead_last; + + anon3_LoopHead_last: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + result := result + x; + x := x - 1; + havoc x; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + assume false; + return; + + anon3_LoopDone: + assume {:partition} 0 >= x; + goto anon2; + + anon2: + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 2); + return; +} + + + +implementation _v2.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int) +{ + + entry: + out_result, out_x := in_result, in_x; + goto anon3_LoopHead; + + anon3_LoopHead: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} out_x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + out_result := out_result + out_x; + out_x := out_x - 1; + havoc out_x; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + call out_result, out_x := _v2.Eval_loop_anon3_LoopHead(out_result, out_x); + return; + + anon3_LoopDone: + assume {:partition} 0 >= out_x; + out_result, out_x := in_result, in_x; + _v2.control_flag := old(_v2.control_flag); + return; +} + + + +var _v1.control_flag: int; + +procedure _v1.Eval(x: int) returns (result: int); + modifies _v1.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "x"} true; + free ensures {:io_dependency "result", "x"} true; + + + +procedure _v1.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int); + modifies _v1.control_flag; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + free ensures {:io_dependency "control_flag", "control_flag", "in_x"} true; + free ensures {:io_dependency "out_result", "in_result", "in_x"} true; + free ensures {:io_dependency "out_x", "in_x"} true; + + + +implementation _v1.Eval(x.1: int) returns (result: int) +{ + var x: int; + + anon0: + x := x.1; + result := 0; + _v1.control_flag := 0; + goto anon3_LoopHead; + + anon3_LoopHead: + call result, x := _v1.Eval_loop_anon3_LoopHead(result, x); + goto anon3_LoopHead_last; + + anon3_LoopHead_last: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + result := result + x; + x := x - 1; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + assume false; + return; + + anon3_LoopDone: + assume {:partition} 0 >= x; + goto anon2; + + anon2: + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 2); + return; +} + + + +implementation _v1.Eval_loop_anon3_LoopHead(in_result: int, in_x: int) returns (out_result: int, out_x: int) +{ + + entry: + out_result, out_x := in_result, in_x; + goto anon3_LoopHead; + + anon3_LoopHead: + goto anon3_LoopDone, anon3_LoopBody; + + anon3_LoopBody: + assume {:partition} out_x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + out_result := out_result + out_x; + out_x := out_x - 1; + goto anon3_LoopBody_dummy; + + anon3_LoopBody_dummy: + call out_result, out_x := _v1.Eval_loop_anon3_LoopHead(out_result, out_x); + return; + + anon3_LoopDone: + assume {:partition} 0 >= out_x; + out_result, out_x := in_result, in_x; + _v1.control_flag := old(_v1.control_flag); + return; +} + + + +function {:inline true} MS$_v1.Eval$_v2.Eval(_v1.x: int, + _v1.control_flag_old: int, + _v1.control_flag_: int, + _v1.result: int, + _v2.x: int, + _v2.control_flag_old: int, + _v2.control_flag_: int, + _v2.result: int) + : bool +{ + true +} + +const {:existential true} _houdini_Eval_control_flag_0: bool; + +const {:existential true} _houdini_Eval_result_1: bool; + +procedure MS_Check__v1.Eval___v2.Eval(_v1.x: int, _v2.x: int) returns (_v1.result: int, _v2.result: int); + modifies _v1.control_flag, _v2.control_flag; + ensures MS$_v1.Eval$_v2.Eval(_v1.x, + old(_v1.control_flag), + _v1.control_flag, + _v1.result, + _v2.x, + old(_v2.control_flag), + _v2.control_flag, + _v2.result); + ensures _houdini_Eval_control_flag_0 + ==> + old(_v1.control_flag == _v2.control_flag && _v1.x == _v2.x) + ==> _v1.control_flag == _v2.control_flag; + ensures _houdini_Eval_result_1 ==> old(_v1.x == _v2.x) ==> _v1.result == _v2.result; + + + +implementation MS_Check__v1.Eval___v2.Eval(_v1.x: int, _v2.x: int) returns (_v1.result: int, _v2.result: int) +{ + var inline$_v1.Eval$0$x: int; + var inline$_v1.Eval$0$x.1: int; + var inline$_v1.Eval$0$result: int; + var inline$_v1.Eval$0$_v1.control_flag: int; + var inline$_v2.Eval$0$x: int; + var inline$_v2.Eval$0$x.1: int; + var inline$_v2.Eval$0$result: int; + var inline$_v2.Eval$0$_v2.control_flag: int; + var _v1.Eval_loop_anon3_LoopHead_1_done: bool; + var _v1.Eval_loop_anon3_LoopHead_in_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_2: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_2: int; + var _v2.Eval_loop_anon3_LoopHead_2_done: bool; + var _v2.Eval_loop_anon3_LoopHead_in_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_2: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_2: int; + var store__0__v1.control_flag: int; + var store__0__v2.control_flag: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_0_0: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_1_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_0_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_1_0: int; + + START: + _v1.Eval_loop_anon3_LoopHead_1_done, _v2.Eval_loop_anon3_LoopHead_2_done := false, false; + goto inline$_v1.Eval$0$Entry; + + inline$_v1.Eval$0$Entry: + inline$_v1.Eval$0$x.1 := _v1.x; + havoc inline$_v1.Eval$0$x, inline$_v1.Eval$0$result; + inline$_v1.Eval$0$_v1.control_flag := _v1.control_flag; + goto inline$_v1.Eval$0$anon0; + + inline$_v1.Eval$0$anon0: + inline$_v1.Eval$0$x := inline$_v1.Eval$0$x.1; + inline$_v1.Eval$0$result := 0; + _v1.control_flag := 0; + goto inline$_v1.Eval$0$anon3_LoopHead; + + inline$_v1.Eval$0$anon3_LoopHead: + _v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v1.Eval_loop_anon3_LoopHead_in_1_2 := inline$_v1.Eval$0$result, inline$_v1.Eval$0$x, _v1.control_flag; + call inline$_v1.Eval$0$result, inline$_v1.Eval$0$x := _v1.Eval_loop_anon3_LoopHead(inline$_v1.Eval$0$result, inline$_v1.Eval$0$x); + _v1.Eval_loop_anon3_LoopHead_1_done := true; + _v1.Eval_loop_anon3_LoopHead_out_1_0, _v1.Eval_loop_anon3_LoopHead_out_1_1, _v1.Eval_loop_anon3_LoopHead_out_1_2 := inline$_v1.Eval$0$result, inline$_v1.Eval$0$x, _v1.control_flag; + goto inline$_v1.Eval$0$anon3_LoopHead_last; + + inline$_v1.Eval$0$anon3_LoopHead_last: + goto inline$_v1.Eval$0$anon3_LoopDone, inline$_v1.Eval$0$anon3_LoopBody; + + inline$_v1.Eval$0$anon3_LoopBody: + assume {:partition} inline$_v1.Eval$0$x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + inline$_v1.Eval$0$result := inline$_v1.Eval$0$result + inline$_v1.Eval$0$x; + inline$_v1.Eval$0$x := inline$_v1.Eval$0$x - 1; + goto inline$_v1.Eval$0$anon3_LoopBody_dummy; + + inline$_v1.Eval$0$anon3_LoopBody_dummy: + assume false; + goto inline$_v1.Eval$0$Return; + + inline$_v1.Eval$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v1.Eval$0$x; + goto inline$_v1.Eval$0$anon2; + + inline$_v1.Eval$0$anon2: + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 2); + goto inline$_v1.Eval$0$Return; + + inline$_v1.Eval$0$Return: + assume true; + assume true; + assume true; + assume true; + _v1.result := inline$_v1.Eval$0$result; + goto START$1; + + START$1: + goto inline$_v2.Eval$0$Entry; + + inline$_v2.Eval$0$Entry: + inline$_v2.Eval$0$x.1 := _v2.x; + havoc inline$_v2.Eval$0$x, inline$_v2.Eval$0$result; + inline$_v2.Eval$0$_v2.control_flag := _v2.control_flag; + goto inline$_v2.Eval$0$anon0; + + inline$_v2.Eval$0$anon0: + inline$_v2.Eval$0$x := inline$_v2.Eval$0$x.1; + inline$_v2.Eval$0$result := 0; + _v2.control_flag := 0; + goto inline$_v2.Eval$0$anon3_LoopHead; + + inline$_v2.Eval$0$anon3_LoopHead: + _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1, _v2.Eval_loop_anon3_LoopHead_in_2_2 := inline$_v2.Eval$0$result, inline$_v2.Eval$0$x, _v2.control_flag; + call inline$_v2.Eval$0$result, inline$_v2.Eval$0$x := _v2.Eval_loop_anon3_LoopHead(inline$_v2.Eval$0$result, inline$_v2.Eval$0$x); + _v2.Eval_loop_anon3_LoopHead_2_done := true; + _v2.Eval_loop_anon3_LoopHead_out_2_0, _v2.Eval_loop_anon3_LoopHead_out_2_1, _v2.Eval_loop_anon3_LoopHead_out_2_2 := inline$_v2.Eval$0$result, inline$_v2.Eval$0$x, _v2.control_flag; + goto inline$_v2.Eval$0$anon3_LoopHead_last; + + inline$_v2.Eval$0$anon3_LoopHead_last: + goto inline$_v2.Eval$0$anon3_LoopDone, inline$_v2.Eval$0$anon3_LoopBody; + + inline$_v2.Eval$0$anon3_LoopBody: + assume {:partition} inline$_v2.Eval$0$x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + inline$_v2.Eval$0$result := inline$_v2.Eval$0$result + inline$_v2.Eval$0$x; + inline$_v2.Eval$0$x := inline$_v2.Eval$0$x - 1; + havoc inline$_v2.Eval$0$x; + goto inline$_v2.Eval$0$anon3_LoopBody_dummy; + + inline$_v2.Eval$0$anon3_LoopBody_dummy: + assume false; + goto inline$_v2.Eval$0$Return; + + inline$_v2.Eval$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v2.Eval$0$x; + goto inline$_v2.Eval$0$anon2; + + inline$_v2.Eval$0$anon2: + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 2); + goto inline$_v2.Eval$0$Return; + + inline$_v2.Eval$0$Return: + assume true; + assume true; + assume true; + assume true; + _v2.result := inline$_v2.Eval$0$result; + goto START$2; + + START$2: + goto MS_L_0_0; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done; + store__0__v1.control_flag := _v1.control_flag; + store__0__v2.control_flag := _v2.control_flag; + _v1.control_flag := _v1.Eval_loop_anon3_LoopHead_in_1_2; + _v2.control_flag := _v2.Eval_loop_anon3_LoopHead_in_2_2; + call out__v1.Eval_loop_anon3_LoopHead_out_1_0_0, out__v1.Eval_loop_anon3_LoopHead_out_1_1_0, out__v2.Eval_loop_anon3_LoopHead_out_2_0_0, out__v2.Eval_loop_anon3_LoopHead_out_2_1_0 := MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1); + assume _v1.control_flag == _v1.Eval_loop_anon3_LoopHead_out_1_2; + assume _v2.control_flag == _v2.Eval_loop_anon3_LoopHead_out_2_2; + assume _v1.Eval_loop_anon3_LoopHead_out_1_0 + == out__v1.Eval_loop_anon3_LoopHead_out_1_0_0 + && _v1.Eval_loop_anon3_LoopHead_out_1_1 + == out__v1.Eval_loop_anon3_LoopHead_out_1_1_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_0 + == out__v2.Eval_loop_anon3_LoopHead_out_2_0_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_1 + == out__v2.Eval_loop_anon3_LoopHead_out_2_1_0; + _v1.control_flag := store__0__v1.control_flag; + _v2.control_flag := store__0__v2.control_flag; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; +} + + + +function {:inline true} MS$_v1.Eval_loop_anon3_LoopHead$_v2.Eval_loop_anon3_LoopHead(_v1.in_result: int, + _v1.in_x: int, + _v1.control_flag_old: int, + _v1.control_flag_: int, + _v1.out_result: int, + _v1.out_x: int, + _v2.in_result: int, + _v2.in_x: int, + _v2.control_flag_old: int, + _v2.control_flag_: int, + _v2.out_result: int, + _v2.out_x: int) + : bool +{ + true +} + +const {:existential true} _houdini_Eval_loop_anon3_LoopHead_control_flag_2: bool; + +const {:existential true} _houdini_Eval_loop_anon3_LoopHead_out_result_3: bool; + +const {:existential true} _houdini_Eval_loop_anon3_LoopHead_out_x_4: bool; + +procedure MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.in_result: int, _v1.in_x: int, _v2.in_result: int, _v2.in_x: int) + returns (_v1.out_result: int, _v1.out_x: int, _v2.out_result: int, _v2.out_x: int); + modifies _v1.control_flag, _v2.control_flag; + ensures MS$_v1.Eval_loop_anon3_LoopHead$_v2.Eval_loop_anon3_LoopHead(_v1.in_result, + _v1.in_x, + old(_v1.control_flag), + _v1.control_flag, + _v1.out_result, + _v1.out_x, + _v2.in_result, + _v2.in_x, + old(_v2.control_flag), + _v2.control_flag, + _v2.out_result, + _v2.out_x); + ensures _houdini_Eval_loop_anon3_LoopHead_control_flag_2 + ==> + old(_v1.control_flag == _v2.control_flag && _v1.in_x == _v2.in_x) + ==> _v1.control_flag == _v2.control_flag; + ensures _houdini_Eval_loop_anon3_LoopHead_out_result_3 + ==> + old(_v1.in_result == _v2.in_result && _v1.in_x == _v2.in_x) + ==> _v1.out_result == _v2.out_result; + ensures _houdini_Eval_loop_anon3_LoopHead_out_x_4 + ==> + old(_v1.in_x == _v2.in_x) + ==> _v1.out_x == _v2.out_x; + + + +implementation MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.in_result: int, _v1.in_x: int, _v2.in_result: int, _v2.in_x: int) + returns (_v1.out_result: int, _v1.out_x: int, _v2.out_result: int, _v2.out_x: int) +{ + var inline$_v1.Eval_loop_anon3_LoopHead$0$in_result: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$in_x: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$out_result: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$out_x: int; + var inline$_v1.Eval_loop_anon3_LoopHead$0$_v1.control_flag: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$in_result: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$in_x: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$out_result: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$out_x: int; + var inline$_v2.Eval_loop_anon3_LoopHead$0$_v2.control_flag: int; + var _v1.Eval_loop_anon3_LoopHead_1_done: bool; + var _v1.Eval_loop_anon3_LoopHead_in_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_in_1_2: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_0: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_1: int; + var _v1.Eval_loop_anon3_LoopHead_out_1_2: int; + var _v2.Eval_loop_anon3_LoopHead_2_done: bool; + var _v2.Eval_loop_anon3_LoopHead_in_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_in_2_2: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_0: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_1: int; + var _v2.Eval_loop_anon3_LoopHead_out_2_2: int; + var store__0__v1.control_flag: int; + var store__0__v2.control_flag: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_0_0: int; + var out__v1.Eval_loop_anon3_LoopHead_out_1_1_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_0_0: int; + var out__v2.Eval_loop_anon3_LoopHead_out_2_1_0: int; + + START: + _v1.Eval_loop_anon3_LoopHead_1_done, _v2.Eval_loop_anon3_LoopHead_2_done := false, false; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$Entry; + + inline$_v1.Eval_loop_anon3_LoopHead$0$Entry: + inline$_v1.Eval_loop_anon3_LoopHead$0$in_result := _v1.in_result; + inline$_v1.Eval_loop_anon3_LoopHead$0$in_x := _v1.in_x; + havoc inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v1.Eval_loop_anon3_LoopHead$0$_v1.control_flag := _v1.control_flag; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$entry; + + inline$_v1.Eval_loop_anon3_LoopHead$0$entry: + inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$in_result, inline$_v1.Eval_loop_anon3_LoopHead$0$in_x; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopHead; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopHead: + goto inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopDone, inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody: + assume {:partition} inline$_v1.Eval_loop_anon3_LoopHead$0$out_x > 0; + _v1.control_flag := _v2.control_UIF(_v1.control_flag, 1); + inline$_v1.Eval_loop_anon3_LoopHead$0$out_result := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result + + inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$out_x - 1; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy: + _v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v1.Eval_loop_anon3_LoopHead_in_1_2 := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x, _v1.control_flag; + call inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := _v1.Eval_loop_anon3_LoopHead(inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x); + _v1.Eval_loop_anon3_LoopHead_1_done := true; + _v1.Eval_loop_anon3_LoopHead_out_1_0, _v1.Eval_loop_anon3_LoopHead_out_1_1, _v1.Eval_loop_anon3_LoopHead_out_1_2 := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x, _v1.control_flag; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v1.Eval_loop_anon3_LoopHead$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v1.Eval_loop_anon3_LoopHead$0$out_result, inline$_v1.Eval_loop_anon3_LoopHead$0$out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$in_result, inline$_v1.Eval_loop_anon3_LoopHead$0$in_x; + _v1.control_flag := inline$_v1.Eval_loop_anon3_LoopHead$0$_v1.control_flag; + goto inline$_v1.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v1.Eval_loop_anon3_LoopHead$0$Return: + assume true; + assume true; + assume true; + assume true; + assume true; + assume true; + _v1.out_result := inline$_v1.Eval_loop_anon3_LoopHead$0$out_result; + _v1.out_x := inline$_v1.Eval_loop_anon3_LoopHead$0$out_x; + goto START$1; + + START$1: + goto inline$_v2.Eval_loop_anon3_LoopHead$0$Entry; + + inline$_v2.Eval_loop_anon3_LoopHead$0$Entry: + inline$_v2.Eval_loop_anon3_LoopHead$0$in_result := _v2.in_result; + inline$_v2.Eval_loop_anon3_LoopHead$0$in_x := _v2.in_x; + havoc inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v2.Eval_loop_anon3_LoopHead$0$_v2.control_flag := _v2.control_flag; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$entry; + + inline$_v2.Eval_loop_anon3_LoopHead$0$entry: + inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$in_result, inline$_v2.Eval_loop_anon3_LoopHead$0$in_x; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopHead; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopHead: + goto inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopDone, inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody: + assume {:partition} inline$_v2.Eval_loop_anon3_LoopHead$0$out_x > 0; + _v2.control_flag := _v2.control_UIF(_v2.control_flag, 1); + inline$_v2.Eval_loop_anon3_LoopHead$0$out_result := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result + + inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$out_x - 1; + havoc inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopBody_dummy: + _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1, _v2.Eval_loop_anon3_LoopHead_in_2_2 := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x, _v2.control_flag; + call inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := _v2.Eval_loop_anon3_LoopHead(inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x); + _v2.Eval_loop_anon3_LoopHead_2_done := true; + _v2.Eval_loop_anon3_LoopHead_out_2_0, _v2.Eval_loop_anon3_LoopHead_out_2_1, _v2.Eval_loop_anon3_LoopHead_out_2_2 := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x, _v2.control_flag; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v2.Eval_loop_anon3_LoopHead$0$anon3_LoopDone: + assume {:partition} 0 >= inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + inline$_v2.Eval_loop_anon3_LoopHead$0$out_result, inline$_v2.Eval_loop_anon3_LoopHead$0$out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$in_result, inline$_v2.Eval_loop_anon3_LoopHead$0$in_x; + _v2.control_flag := inline$_v2.Eval_loop_anon3_LoopHead$0$_v2.control_flag; + goto inline$_v2.Eval_loop_anon3_LoopHead$0$Return; + + inline$_v2.Eval_loop_anon3_LoopHead$0$Return: + assume true; + assume true; + assume true; + assume true; + assume true; + assume true; + _v2.out_result := inline$_v2.Eval_loop_anon3_LoopHead$0$out_result; + _v2.out_x := inline$_v2.Eval_loop_anon3_LoopHead$0$out_x; + goto START$2; + + START$2: + goto MS_L_0_0; + + MS_L_0_0: + goto MS_L_taken_0, MS_L_not_taken_0; + + MS_L_taken_0: + assume _v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done; + store__0__v1.control_flag := _v1.control_flag; + store__0__v2.control_flag := _v2.control_flag; + _v1.control_flag := _v1.Eval_loop_anon3_LoopHead_in_1_2; + _v2.control_flag := _v2.Eval_loop_anon3_LoopHead_in_2_2; + call out__v1.Eval_loop_anon3_LoopHead_out_1_0_0, out__v1.Eval_loop_anon3_LoopHead_out_1_1_0, out__v2.Eval_loop_anon3_LoopHead_out_2_0_0, out__v2.Eval_loop_anon3_LoopHead_out_2_1_0 := MS_Check__v1.Eval_loop_anon3_LoopHead___v2.Eval_loop_anon3_LoopHead(_v1.Eval_loop_anon3_LoopHead_in_1_0, _v1.Eval_loop_anon3_LoopHead_in_1_1, _v2.Eval_loop_anon3_LoopHead_in_2_0, _v2.Eval_loop_anon3_LoopHead_in_2_1); + assume _v1.control_flag == _v1.Eval_loop_anon3_LoopHead_out_1_2; + assume _v2.control_flag == _v2.Eval_loop_anon3_LoopHead_out_2_2; + assume _v1.Eval_loop_anon3_LoopHead_out_1_0 + == out__v1.Eval_loop_anon3_LoopHead_out_1_0_0 + && _v1.Eval_loop_anon3_LoopHead_out_1_1 + == out__v1.Eval_loop_anon3_LoopHead_out_1_1_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_0 + == out__v2.Eval_loop_anon3_LoopHead_out_2_0_0 + && _v2.Eval_loop_anon3_LoopHead_out_2_1 + == out__v2.Eval_loop_anon3_LoopHead_out_2_1_0; + _v1.control_flag := store__0__v1.control_flag; + _v2.control_flag := store__0__v2.control_flag; + goto MS_L_meet_0; + + MS_L_not_taken_0: + assume !(_v1.Eval_loop_anon3_LoopHead_1_done && _v2.Eval_loop_anon3_LoopHead_2_done); + goto MS_L_meet_0; + + MS_L_meet_0: + return; +} + + diff --git a/Test/houdini/mergedProgSingle_res_ex2.bpl.expect b/Test/houdini/mergedProgSingle_res_ex2.bpl.expect new file mode 100644 index 00000000..f551fc90 --- /dev/null +++ b/Test/houdini/mergedProgSingle_res_ex2.bpl.expect @@ -0,0 +1,8 @@ +Assignment computed by Houdini: +_houdini_Eval_control_flag_0 = False +_houdini_Eval_result_1 = False +_houdini_Eval_loop_anon3_LoopHead_control_flag_2 = False +_houdini_Eval_loop_anon3_LoopHead_out_result_3 = False +_houdini_Eval_loop_anon3_LoopHead_out_x_4 = False + +Boogie program verifier finished with 6 verified, 0 errors -- cgit v1.2.3